High severity · published Oct 21, 2019
CVE-2019-17498
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary…
8.1
CVSS
3.8%
EPSS
No
On KEV
Description
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Active IQ Unified Manager · Netapp
All versions, or not specified · source: NVD
BO
Bootstrap OS · Netapp
All versions, or not specified · source: NVD
DL
Debian Linux · Debian
8.0; 9.0 · source: NVD
ES
Element Software · Netapp
All versions, or not specified · source: NVD
FE
Fedora · Fedoraproject
30; 31 · source: NVD
HM
Hci Management Node · Netapp
All versions, or not specified · source: NVD
LE
Leap · Opensuse
15.1 · source: NVD
LI
Libssh2 · Libssh2
through 1.9.0 · source: NVD
OS
Ontap Select Deploy Administration Utility · Netapp
All versions, or not specified · source: NVD
SO
Solidfire · Netapp
All versions, or not specified · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-17498
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-17498
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html
packetstormsecurity.com
http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html
Broken Link
https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
Exploit
https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498
Exploit
https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480
Patch
https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability