Out-of-bounds write in libssh2 - CVE-2020-22218

Vulnerability identifier: #VU80523

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-22218

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to usage of an uninitialized value within the _libssh2_transport_read() function in transport.c. A remote attacker can pass specially crafted input to the application, trigger memory corruption and perform a denial of service (DoS) attack.

libssh2
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
F5OS
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
SUSE Enterprise Storage
Fedora
Ubuntu
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Basesystem Module
openSUSE Leap
SmartFabric Storage Software
BIG-IP
DataStage on Cloud Pak for Data
SmartFabric OS10
ObjectScale
Storage Defender – Data Protect
Enterprise SONiC
XtremIO X2
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
BIG-IQ Centralized Management
PeopleSoft Enterprise PeopleTools
libssh2-1 (Ubuntu package)
libssh2
libssh2-1-32bit
libssh2-devel
libssh2_org-debugsource
libssh2-1-debuginfo
libssh2-1
libssh2-1-debuginfo-32bit
libssh2-docs
libssh2 (Red Hat package)
libssh2-1-32bit-debuginfo
Session Smart Router

Install updates from vendor's website.

libssh2 - update to 1.10.0
F5OS - addressed in versions 1.5.2, 1.7.0
SmartFabric Storage Software - update to 1.4.3
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF02
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF02
SmartFabric OS10 - update to 10.5.4.11
libssh2-1 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.8.0-1ubuntu0.1, 1.8.0-2.1ubuntu0.1
ObjectScale - update to 1.4.0
libssh2 - update to 1.4.2-3.14
libssh2-1-32bit - addressed in versions 1.4.3-26.5.1, 1.9.0-150000.4.16.1
libssh2-devel - addressed in versions 1.4.3-26.5.1, 1.9.0-150000.4.16.1
libssh2_org-debugsource - addressed in versions 1.4.3-26.5.1, 1.9.0-150000.4.16.1
libssh2-1-debuginfo - addressed in versions 1.4.3-26.5.1, 1.9.0-150000.4.16.1
libssh2-1 - addressed in versions 1.4.3-26.5.1, 1.9.0-150000.4.16.1
libssh2-1-debuginfo-32bit - update to 1.4.3-26.5.1
libssh2-devel - update to 1.8.0-4
libssh2 - update to 1.8.0-4
libssh2-docs - update to 1.8.0-4
libssh2 (Red Hat package) - update to 1.8.0-4.el7_9.1
libssh2-1-32bit-debuginfo - update to 1.9.0-150000.4.16.1
libssh2 - update to 1.10.0-1.el8
Storage Defender – Data Protect - update to 2.0
Enterprise SONiC - update to 4.1.2
Session Smart Router - addressed in versions 6.2.10, 6.3.7
XtremIO X2 - update to 6.4.2-13

• https://github.com/libssh2/libssh2/pull/476
• https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df

• Denial of service in libssh2
• Fedora EPEL 8 update for libssh2
• SUSE update for libssh2_org
• Ubuntu update for libssh2
• SUSE update for libssh2_org
• Amazon Linux AMI update for libssh2
• Red Hat Enterprise Linux 7 update for libssh2
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Dell EMC Enterprise SONiC
• Multiple vulnerabilities in IBM Storage Defender - Data Protect
• CentOS 7 update for libssh2
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in Dell ObjectScale
• Denial of service in F5 BIG-IP libssh2
• Denial of service in F5 BIG-IQ Centralized Management libssh2 component
• Denial of service in F5OS libssh2 component
• Multiple vulnerabilities in Dell XtremIO X2
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Anolis OS update for libssh2
• Dell SmartFabric Storage Software update for third-party components
• IBM DataStage on Cloud Pak for Data update for libssh2
• Juniper Session Smart Router update for third-party components