Description
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libssh2 | 1.9.0-1 | — |
| Debian 13 | libssh2 | 1.9.0-1 | — |
| Debian 12 | libssh2 | 1.9.0-1 | — |
| Debian 10 | libssh2 | 1.8.0-2.1+deb10u1 | DLA-3559-1 |
| Debian 9 | libssh2 | 1.7.0-1+deb9u2 | DLA-2848-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | libssh2 | 1.4.3-4.1+deb8u4 | DLA-1730-3 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libssh2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libssh2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libssh2 | 1.5.0-2ubuntu0.1+esm1 | USN-5308-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | libssh2 | 1.4.3-2ubuntu0.2+esm2 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.23 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.22 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.21 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.20 | libssh2 | 1.9.0-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.18 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.17 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.16 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.15 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.14 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.13 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.12 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.11 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.10 | libssh2 | 1.9.0-r0 | — |
| Alpine v3.9 | libssh2 | 1.9.0-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
viz27/Libssh2-Exploit ★ 1 · Oct 3, 2019
Create an exploit to libssh2 vulnerabulity described in CVE-2019-13115
-
CSSProject/libssh2-Exploit ★ 0 · Oct 3, 2019
Create an exploit to libssh2 vulnerabulity described in CVE-2019-13115
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- USN-5308-1 libssh2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DLA-1730-3 libssh2 - regression update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2848-1 libssh2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3559-1 libssh2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2023-2301 libssh2: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 10, 2023
References
- https://github.com/libssh2/libssh2/pull/350
- https://libssh2.org/changes.html
- https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa
- https://blog.semmle.com/libssh2-integer-overflow/
- [debian-lts-announce] 20190725 [SECURITY] [DLA 1730-3] libssh2 regression update mailing-list
- FEDORA-2019-9d85600fc7 vendor-advisory
- FEDORA-2019-5885663621 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190806-0002/
- https://support.f5.com/csp/article/K13322484
- https://support.f5.com/csp/article/K13322484?utm_source=f5support&%3Butm_medium=RSS
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list
- [debian-lts-announce] 20211217 [SECURITY] [DLA 2848-1] libssh2 security update mailing-list
- http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html
- [debian-lts-announce] 20230908 [SECURITY] [DLA 3559-1] libssh2 security update mailing-list