PT-2020-6930 · Libssh2+6 · Libssh2+6

Ltx2018 · Published 2020-05-28 · Updated 2024-01-12 · CVE-2020-22218

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libssh2 version 1.10.0

Description An issue was discovered in the libssh2 packet add function that allows attackers to access out of bounds memory, potentially leading to a denial of service. This issue is related to a buffer overflow in the libssh2 library, which implements the SSH2 protocol.

Recommendations For libssh2 version 1.10.0, consider updating to a newer version that addresses this issue, as accessing out of bounds memory can lead to service disruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

AZL-28594

BDU:2023-07619

CESA-2023_5615

CVE-2020-22218

DLA-3559-1

OPENSUSE-SU-2023_3555-1

RHSA-2023:5615

RHSA-2023_5615

ROSA-SA-2023-2278

SUSE-SU-2023:3555-1

SUSE-SU-2023:3738-1

SUSE-SU-2023_3555-1

SUSE-SU-2023_3738-1

USN-6371-1

Affected Products

Astra Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Libssh2

References · 28

• https://github.com/libssh2/libssh2/pull/476 · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-22218 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-22218 · Security Note
• https://osv.dev/vulnerability/USN-6371-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-22218 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-28594 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-22218 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3738-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07619 · Security Note
• https://ubuntu.com/security/notices/USN-6371-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3559-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22218 · Vendor Advisory