Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-3862: An out of bounds read flaw was discovered in libssh2 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker who compromises a SSH server may be able to cause a denial of service or read data in the client memory. 1687312: CVE-2019-3862 libssh2: Out-of-bounds memory comparison with specially crafted message channel request
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libssh2 | 0:1.4.3-12.amzn2.2.2 |
| Amazon Linux · 2 | libssh2-debuginfo | 0:1.4.3-12.amzn2.2.2 |
| Amazon Linux · 2 | libssh2-devel | 0:1.4.3-12.amzn2.2.2 |
| Amazon Linux · 2 | libssh2-docs | 0:1.4.3-12.amzn2.2.2 |
Vulnerabilities 1
-
High 7.3
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an ex…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-3862.html