Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-17498: In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. 1766898: CVE-2019-17498 libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | libssh2 | 0:1.4.3-12.amzn2.2.3 |
| Amazon Linux · 2 | libssh2-debuginfo | 0:1.4.3-12.amzn2.2.3 |
| Amazon Linux · 2 | libssh2-devel | 0:1.4.3-12.amzn2.2.3 |
| Amazon Linux · 2 | libssh2-docs | 0:1.4.3-12.amzn2.2.3 |
Vulnerabilities 1
-
Unscored —CVE-2019-17498 Public exploit
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds ch…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-17498.html