A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed longname field within an SSH_FXP_NAME message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libssh | Libssh | * | 0.11.3 (including) |
| Enterprise_linux | Redhat | 9.0 (including) | 9.0 (including) |
| Enterprise_linux | Redhat | 10.0 (including) | 10.0 (including) |
| Red Hat Enterprise Linux 10 | RedHat | libssh-0:0.12.0-2.el10 | * |
| Red Hat Enterprise Linux 9 | RedHat | libssh-0:0.10.4-18.el9 | * |
| Red Hat Enterprise Linux 9 | RedHat | libssh-0:0.10.4-18.el9 | * |
| Libssh | Ubuntu | devel | * |
| Libssh | Ubuntu | esm-infra-legacy/xenial | * |
| Libssh | Ubuntu | esm-infra/bionic | * |
| Libssh | Ubuntu | esm-infra/focal | * |
| Libssh | Ubuntu | esm-infra/xenial | * |
| Libssh | Ubuntu | jammy | * |
| Libssh | Ubuntu | noble | * |
| Libssh | Ubuntu | questing | * |