{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "* SECURITY UPDATE: integer overflow in transport read allowing\n out-of-bounds write via crafted SSH packet\n - debian/patches/CVE-2019-3855.patch: add packet_length bounds\n check against LIBSSH2_PACKET_MAXPAYLOAD in transport read\n - CVE-2019-3855\n * SECURITY UPDATE: integer overflow in keyboard-interactive handling\n allowing out-of-bounds write via crafted num-prompts value\n - debian/patches/CVE-2019-3856.patch: cap num_prompts at 100 to\n prevent excessive allocation in keyboard-interactive auth\n - CVE-2019-3856\n * SECURITY UPDATE: integer overflow in keyboard-interactive response\n allowing out-of-bounds write via crafted response lengths\n - debian/patches/CVE-2019-3863.patch: add SIZE_MAX overflow check\n in keyboard-interactive response packet length calculation\n - CVE-2019-3863\n * SECURITY UPDATE: out-of-bounds memory access in kex exchange when\n reading malformed data in diffie_hellman_sha1/sha256\n - debian/patches/CVE-2019-13115.patch: add _libssh2_copy_string()\n bounds-checked helper and use it in kex DH group exchange\n - CVE-2019-13115", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu16.04els/advisories/2026/clsa-2026_1776864708.json" } ], "tracking": { "current_release_date": "2026-04-22T13:32:36Z", "generator": { "date": "2026-04-22T13:32:36Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1776864708", "initial_release_date": "2026-04-22T13:32:36Z", "revision_history": [ { "date": "2026-04-22T13:32:36Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "Fix CVE(s): CVE-2019-13115, CVE-2019-3855, CVE-2019-3856, CVE-2019-3863" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Ubuntu 16.04", "product": { "name": "Ubuntu 16.04", "product_id": "Ubuntu-16", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "product": { "name": "libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "product_id": "libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssh2-1@1.5.0-2ubuntu0.1%2Btuxcare.els4?arch=amd64" } } }, { "category": "product_version", "name": "libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "product": { "name": "libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "product_id": "libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libssh2-1-dev@1.5.0-2ubuntu0.1%2Btuxcare.els4?arch=amd64" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64 as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" }, "product_reference": "libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "relates_to_product_reference": "Ubuntu-16" }, { "category": "default_component_of", "full_product_name": { "name": "libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64 as a component of Ubuntu 16.04", "product_id": "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" }, "product_reference": "libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "relates_to_product_reference": "Ubuntu-16" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-13115", "cwe": { "id": "CWE-125", "name": "Out-of-bounds Read" }, "notes": [ { "category": "description", "text": "In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-13115" }, { "category": "external", "summary": "http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html", "url": "http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html" }, { "category": "external", "summary": "https://blog.semmle.com/libssh2-integer-overflow/", "url": "https://blog.semmle.com/libssh2-integer-overflow/" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa", "url": "https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa" }, { "category": "external", "summary": "https://github.com/libssh2/libssh2/pull/350", "url": "https://github.com/libssh2/libssh2/pull/350" }, { "category": "external", "summary": "https://libssh2.org/changes.html", "url": "https://libssh2.org/changes.html" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E", "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E" }, { "category": "external", "summary": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E", "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html", "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html", "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20190806-0002/", "url": "https://security.netapp.com/advisory/ntap-20190806-0002/" }, { "category": "external", "summary": "https://support.f5.com/csp/article/K13322484", "url": "https://support.f5.com/csp/article/K13322484" }, { "category": "external", "summary": "https://support.f5.com/csp/article/K13322484?utm_source=f5support&%3Butm_medium=RSS", "url": "https://support.f5.com/csp/article/K13322484?utm_source=f5support&%3Butm_medium=RSS" } ], "release_date": "2019-07-16T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-22T13:31:50.992175Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708", "product_ids": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2019-3856", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-3856" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0679", "url": "https://access.redhat.com/errata/RHSA-2019:0679" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1175", "url": "https://access.redhat.com/errata/RHSA-2019:1175" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1652", "url": "https://access.redhat.com/errata/RHSA-2019:1652" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1791", "url": "https://access.redhat.com/errata/RHSA-2019:1791" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1943", "url": "https://access.redhat.com/errata/RHSA-2019:1943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2399", "url": "https://access.redhat.com/errata/RHSA-2019:2399" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3856" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html", "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Apr/25", "url": "https://seclists.org/bugtraq/2019/Apr/25" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20190327-0005/", "url": "https://security.netapp.com/advisory/ntap-20190327-0005/" }, { "category": "external", "summary": "https://www.debian.org/security/2019/dsa-4431", "url": "https://www.debian.org/security/2019/dsa-4431" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3856.html", "url": "https://www.libssh2.org/CVE-2019-3856.html" }, { "category": "external", "summary": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" } ], "release_date": "2019-03-25T19:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-22T13:31:50.992175Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708", "product_ids": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2019-3855", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-3855" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html" }, { "category": "external", "summary": "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html", "url": "http://packetstormsecurity.com/files/152136/Slackware-Security-Advisory-libssh2-Updates.html" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2019/Sep/42", "url": "http://seclists.org/fulldisclosure/2019/Sep/42" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2019/03/18/3", "url": "http://www.openwall.com/lists/oss-security/2019/03/18/3" }, { "category": "external", "summary": "http://www.securityfocus.com/bid/107485", "url": "http://www.securityfocus.com/bid/107485" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0679", "url": "https://access.redhat.com/errata/RHSA-2019:0679" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1175", "url": "https://access.redhat.com/errata/RHSA-2019:1175" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1652", "url": "https://access.redhat.com/errata/RHSA-2019:1652" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1791", "url": "https://access.redhat.com/errata/RHSA-2019:1791" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1943", "url": "https://access.redhat.com/errata/RHSA-2019:1943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2399", "url": "https://access.redhat.com/errata/RHSA-2019:2399" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3855" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html", "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCWEA5ZCLKRDUK62QVVYMFWLWKOPX3LO/" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Apr/25", "url": "https://seclists.org/bugtraq/2019/Apr/25" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Mar/25", "url": "https://seclists.org/bugtraq/2019/Mar/25" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Sep/49", "url": "https://seclists.org/bugtraq/2019/Sep/49" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20190327-0005/", "url": "https://security.netapp.com/advisory/ntap-20190327-0005/" }, { "category": "external", "summary": "https://support.apple.com/kb/HT210609", "url": "https://support.apple.com/kb/HT210609" }, { "category": "external", "summary": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767", "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-767" }, { "category": "external", "summary": "https://www.debian.org/security/2019/dsa-4431", "url": "https://www.debian.org/security/2019/dsa-4431" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3855.html", "url": "https://www.libssh2.org/CVE-2019-3855.html" }, { "category": "external", "summary": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" } ], "release_date": "2019-03-21T21:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-22T13:31:50.992175Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708", "product_ids": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2019-3863", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2019-3863" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00040.html" }, { "category": "external", "summary": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00003.html" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:0679", "url": "https://access.redhat.com/errata/RHSA-2019:0679" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1175", "url": "https://access.redhat.com/errata/RHSA-2019:1175" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1652", "url": "https://access.redhat.com/errata/RHSA-2019:1652" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1791", "url": "https://access.redhat.com/errata/RHSA-2019:1791" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:1943", "url": "https://access.redhat.com/errata/RHSA-2019:1943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2019:2399", "url": "https://access.redhat.com/errata/RHSA-2019:2399" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3863" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html", "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00032.html" }, { "category": "external", "summary": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5DK6VO2CEUTAJFYIKWNZKEKYMYR3NO2O/" }, { "category": "external", "summary": "https://seclists.org/bugtraq/2019/Apr/25", "url": "https://seclists.org/bugtraq/2019/Apr/25" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20190327-0005/", "url": "https://security.netapp.com/advisory/ntap-20190327-0005/" }, { "category": "external", "summary": "https://www.debian.org/security/2019/dsa-4431", "url": "https://www.debian.org/security/2019/dsa-4431" }, { "category": "external", "summary": "https://www.libssh2.org/CVE-2019-3863.html", "url": "https://www.libssh2.org/CVE-2019-3863.html" }, { "category": "external", "summary": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html", "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html" } ], "release_date": "2019-03-25T18:29:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-04-22T13:31:50.992175Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708", "product_ids": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1776864708" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Ubuntu-16:libssh2-1-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64", "Ubuntu-16:libssh2-1-dev-0:1.5.0-2ubuntu0.1+tuxcare.els4.amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }