CVE-2019-17498 is an integer overflow vulnerability in libssh2 versions 1.9.0 and earlier, affecting products like Debian, Fedora, and OpenSUSE. A malicious SSH server can exploit this flaw during client connection to trigger an out-of-bounds memory read, potentially leading to sensitive information disclosure or a denial of service on the client system. Rated with a CVSS score of 8.1 (High), this vulnerability requires user interaction (connecting to a malicious server) but has low attack complexity. Currently, there is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.9.0CPE matchmatch criteria | cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* | ||
30CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | ||
31CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | ||
15.1CPE matchmatch criteria | cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
HP Universal Scan - Potential Information Disclosure
May 7, 2025HP Universal Scan - Potential Information Disclosure
May 7, 2025HP Universal Scan - Potential Information Disclosure
May 7, 2025HP Universal Scan - Potential Information Disclosure
May 7, 2025CVE-2019-17498
Aug 11, 2020libssh2: integer overflow in SSH_MSG_DISCONNECT logic in packet.c
Oct 16, 2019In libssh2 v1.9.0 and earlier versions the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.
Oct 8, 2019