Skip to content

[automatic] Publish 2 advisories for LibSSH2_jll #198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 27, 2025
+48 −0
Merged

[automatic] Publish 2 advisories for LibSSH2_jll #198

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
99fe550
[create-pull-request] automated change
mbauman Oct 21, 2025
76796e2
Update advisories/published/2025/JLSEC-2025-95.md
mbauman Oct 21, 2025
c84c508
Merge branch 'main' into search-project_libssh2
mbauman Oct 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions advisories/published/2025/JLSEC-0000-mns8yw7md-oz97tn.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
```toml
schema_version = "1.7.3"
id = "JLSEC-0000-mns8yw7md-oz97tn"
modified = 2025-10-21T17:13:02.869Z
upstream = ["CVE-2019-17498"]
references = ["http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html", "http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html", "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/", "https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498", "https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480", "https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c", "https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html", "https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html", "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/", "https://security.netapp.com/advisory/ntap-20220909-0004/", "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html", "http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html", "https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/", "https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498", "https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480", "https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c", "https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html", "https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html", "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/", "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/", "https://security.netapp.com/advisory/ntap-20220909-0004/"]

[[affected]]
pkg = "LibSSH2_jll"
ranges = ["< 1.10.1+0"]

[[jlsec_sources]]
id = "CVE-2019-17498"
imported = 2025-10-21T17:13:02.869Z
modified = 2024-11-21T04:32:22.850Z
published = 2019-10-21T22:15:10.523Z
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-17498"
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2019-17498"
```

# In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer over...

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

24 changes: 24 additions & 0 deletions advisories/published/2025/JLSEC-0000-mns8yw7me-1ry022h.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
```toml
schema_version = "1.7.3"
id = "JLSEC-0000-mns8yw7me-1ry022h"
modified = 2025-10-21T17:13:02.870Z
upstream = ["CVE-2020-22218"]
references = ["https://github.com/libssh2/libssh2/pull/476", "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", "https://security.netapp.com/advisory/ntap-20231006-0002/", "https://github.com/libssh2/libssh2/pull/476", "https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html", "https://security.netapp.com/advisory/ntap-20231006-0002/"]

[[affected]]
pkg = "LibSSH2_jll"
ranges = [">= 1.10.1+0, < 1.11.0+0"]

[[jlsec_sources]]
id = "CVE-2020-22218"
imported = 2025-10-21T17:13:02.870Z
modified = 2024-11-21T05:13:11.797Z
published = 2023-08-22T19:16:19.120Z
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-22218"
html_url = "https://nvd.nist.gov/vuln/detail/CVE-2020-22218"
```

# An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access...

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

2 changes: 1 addition & 1 deletion advisories/published/2025/JLSEC-2025-95.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ ranges = ["< 9.9.1+0"]

[[jlsec_sources]]
id = "CVE-2023-48795"
imported = 2025-10-18T14:10:40.045Z
imported = 2025-10-21T17:13:02.874Z
modified = 2025-09-29T21:56:10.567Z
published = 2023-12-18T16:15:10.897Z
url = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-48795"
Expand Down
Loading