A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.
Weakness
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libssh | Libssh | - (including) | - (including) |
| Hardened_images | Redhat | - (including) | - (including) |
| Enterprise_linux | Redhat | 8.0 (including) | 8.0 (including) |
| Enterprise_linux | Redhat | 9.0 (including) | 9.0 (including) |
| Enterprise_linux | Redhat | 10.0 (including) | 10.0 (including) |
| Red Hat Enterprise Linux 10 | RedHat | libssh-0:0.12.0-3.el10_2 | * |
| Red Hat Enterprise Linux 8 | RedHat | libssh-0:0.9.6-17.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | libssh-0:0.9.6-17.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | libssh-0:0.10.4-19.el9_8 | * |
| Red Hat Enterprise Linux 9 | RedHat | libssh-0:0.10.4-19.el9_8 | * |
| Red Hat Hardened Images | RedHat | libssh-main-0.12.1-4.hum1 | * |
| Libssh | Ubuntu | resolute | * |
| Libssh | Ubuntu | upstream | * |