Описание
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.11.1-4ubuntu1 |
| esm-apps-legacy/xenial | not-affected | 1.5.0-2ubuntu0.1 |
| esm-apps/bionic | not-affected | 1.8.0-1ubuntu0.1 |
| esm-apps/focal | not-affected | 1.8.0-2.1ubuntu0.1 |
| esm-apps/jammy | not-affected | 1.10.0-3 |
| esm-infra-legacy/trusty | not-affected | 1.4.3-2ubuntu0.2 |
| jammy | not-affected | 1.10.0-3 |
| noble | released | 1.11.0-4.1ubuntu0.24.04.2 |
| questing | released | 1.11.1-1ubuntu0.25.10.2 |
| resolute | released | 1.11.1-1ubuntu0.26.04.2 |
Показывать по
EPSS
5.9 Medium
CVSS3
Связанные уязвимости
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.
libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authen ...
EPSS
5.9 Medium
CVSS3