In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in…
Priority MEDIUM 49CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.
Why it matters now
EPSS 0.11659 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* | before 1.9.0 | Vulnerable | The libssh2 Project |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0.0 – 11.70.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:f5:traffix_systems_signaling_delivery_controller:*:*:*:*:*:*:*:* | 5.0.0 – 5.1.0 | Vulnerable | F5 |
- cpe:2.3:a:libssh2:libssh2:*:*:*:*:*:*:*:* Versions before 1.9.0 Vulnerable ·The libssh2 Project
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0.0 – 11.70.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:f5:traffix_systems_signaling_delivery_controller:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.1.0 Vulnerable ·F5
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 Advanced Virtualization | Affected | No fix planned: Will not fix |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13115
- 2026-10-03 Alias added: GHSA-98vm-qgxx-5rjm
References
Advisory 9
- https://github.com/libssh2/libssh2/pull/350
- https://libssh2.org/changes.html
- https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa
- [debian-lts-announce] 20190725 [SECURITY] [DLA 1730-3] libssh2 regression update
- FEDORA-2019-9d85600fc7
- FEDORA-2019-5885663621
- https://security.netapp.com/advisory/ntap-20190806-0002/
- https://support.f5.com/csp/article/K13322484
- [debian-lts-announce] 20211217 [SECURITY] [DLA 2848-1] libssh2 security update
Other 5
- https://support.f5.com/csp/article/K13322484?utm_source=f5support&%3Butm_medium=RSS
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html
- [debian-lts-announce] 20230908 [SECURITY] [DLA 3559-1] libssh2 security update
Sources
- CVE-2019-13115 · CVE Program
- CVE-2019-13115 · NVD
- FIRST EPSS
- GHSA-98vm-qgxx-5rjm · GitHub Advisory Database · CC BY 4.0
- CVE-2019-13115 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences