CVE catalog

CVE-2019-17498

libssh2: CVE-2019-17498

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:P/RL:O/RC:C
Published
Source
[NVD] · [CVE record]
EPSS
3.81% · Oct 25, 2026

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibssh2sid1.11.1-6fixed
Debianlibssh2forky1.11.1-6fixed
Debianlibssh2trixie1.11.1-1+deb13u2fixed
Debianlibssh2trixie-security1.11.1-1+deb13u1fixed
Debianlibssh2bookworm1.10.0-3fixed
Debianlibssh2bookworm-security1.10.0-3+deb12u1fixed
Cpelibssh2Not reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
CpeleapNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown
Cpeactive_iq_unified_managerNot reportedNot reportedunknown
Cpeelement_softwareNot reportedNot reportedunknown
Cpehci_management_nodeNot reportedNot reportedunknown
Cpeontap_select_deploy_administration_utilityNot reportedNot reportedunknown
CpesolidfireNot reportedNot reportedunknown
Cpebootstrap_osNot reportedNot reportedunknown
Ubuntulibssh2pro1.8.0-2.1build1vulnerable
Ubuntulibssh2pro1.8.0-2.1ubuntu0.1vulnerable
Ubuntulibssh2pro1.8.0-2.1ubuntu0.1+esm1vulnerable
Alpinelibssh23.101.9.0-r1fixed
Alpinelibssh23.111.9.0-r1fixed
Alpinelibssh23.121.9.0-r1fixed
Alpinelibssh23.131.9.0-r1fixed
Alpinelibssh23.141.9.0-r1fixed
Alpinelibssh23.151.9.0-r1fixed
Alpinelibssh23.161.9.0-r1fixed
Alpinelibssh23.171.9.0-r1fixed
Alpinelibssh23.181.9.0-r1fixed
Alpinelibssh23.191.9.0-r1fixed
Alpinelibssh23.201.9.0-r1fixed
Alpinelibssh23.211.9.0-r1fixed
Alpinelibssh23.221.9.0-r1fixed
Alpinelibssh23.231.9.0-r1fixed
Alpinelibssh23.241.9.0-r1fixed
Alpinelibssh23.91.9.0-r1fixed
Suselibssh2_orglinux enterprise point of sale 11 sp31.2.9-4.2.12.18.1fixed
Suselibssh2_orghpe helion openstack 81.4.3-20.14.1fixed
Suselibssh2_orgopenstack cloud 71.4.3-20.14.1fixed
Suselibssh2_orgopenstack cloud 81.4.3-20.14.1fixed
Suselibssh2_orgopenstack cloud crowbar 81.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise desktop 12 sp41.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server for sap applications 12 sp11.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server for sap applications 12 sp21.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server for sap applications 12 sp31.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise software development kit 12 sp41.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise software development kit 12 sp51.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp1-ltss1.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp2-ltss1.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp2-bcl1.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp3-ltss1.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp3-bcl1.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp41.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server for sap applications 12 sp41.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server 12 sp51.4.3-20.14.1fixed
Suselibssh2_orglinux enterprise server for sap applications 12 sp51.4.3-20.14.1fixed
Suselibssh2_orgenterprise storage 51.4.3-20.14.1fixed
Opensuselibssh2_orgleap 15.21.9.0-lp152.8.3.1fixed
Suselibssh2_orglinux enterprise high performance computing 15-espos1.8.0-4.10.1fixed
Suselibssh2_orglinux enterprise high performance computing 15-ltss1.8.0-4.10.1fixed
Suselibssh2_orglinux enterprise server 15-ltss1.8.0-4.10.1fixed
Suselibssh2_orglinux enterprise server for sap applications 151.8.0-4.10.1fixed
Suselibssh2_orglinux enterprise micro 5.31.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise micro 5.41.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise micro 5.51.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise module for basesystem 15 sp41.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise module for basesystem 15 sp51.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp1-ltss1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp2-ltss1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp3-espos1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise high performance computing 15 sp3-ltss1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise server 15 sp1-ltss1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise server 15 sp2-ltss1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise server 15 sp3-ltss1.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise server for sap applications 15 sp11.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise server for sap applications 15 sp21.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise server for sap applications 15 sp31.11.0-150000.4.19.1fixed
Suselibssh2_orgmanager proxy 4.21.11.0-150000.4.19.1fixed
Suselibssh2_orgmanager server 4.21.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise micro 5.11.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise micro 5.21.11.0-150000.4.19.1fixed
Suselibssh2_orgenterprise storage 7.11.11.0-150000.4.19.1fixed
Opensuselibssh2_orgleap micro 5.31.11.0-150000.4.19.1fixed
Opensuselibssh2_orgleap micro 5.41.11.0-150000.4.19.1fixed
Opensuselibssh2_orgleap 15.41.11.0-150000.4.19.1fixed
Opensuselibssh2_orgleap 15.51.11.0-150000.4.19.1fixed
Suselibssh2_orglinux enterprise module for basesystem 15 sp11.9.0-4.13.1fixed
Suselibssh2_orglinux enterprise module for basesystem 15 sp21.9.0-4.13.1fixed
Suselibssh2_orglinux enterprise high performance computing 15-espos1.9.0-4.13.1fixed
Suselibssh2_orglinux enterprise high performance computing 15-ltss1.9.0-4.13.1fixed
Suselibssh2_orglinux enterprise server 15-ltss1.9.0-4.13.1fixed
Suselibssh2_orglinux enterprise server for sap applications 151.9.0-4.13.1fixed
Opensuselibssh2_orgleap 15.11.8.0-lp151.6.3.1fixed
Opensuselibssh2_orgleap 15.11.9.0-lp151.6.6.1fixed
Opensuselibssh2_orgtumbleweed1.9.0-3.6fixed
Suselibssh2_orglinux enterprise module for basesystem 151.8.0-4.10.1fixed
Suselibssh2_orglinux enterprise server 11 sp4-ltss1.4.3-17.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibssh2sourcesid1.9.0-1lowNot reported[943562]
Debianlibssh2sourceforky1.9.0-1lowNot reported[943562]
Debianlibssh2sourcetrixie1.9.0-1lowNot reported[943562]
Debianlibssh2sourcebookworm1.9.0-1lowNot reported[943562]
Alpinelibssh2apk3.101.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.111.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.121.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.131.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.141.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.151.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.161.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.171.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.181.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.191.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.201.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.211.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.221.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.231.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.241.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Alpinelibssh2apk3.91.9.0-r1Not reportedALPINE-CVE-2019-17498Not reported
Suselibssh2_orgrpmlinux enterprise point of sale 11 sp31.2.9-4.2.12.18.1Not reportedSUSE-SU-2019:14226-1Not reported
Suselibssh2_orgrpmhpe helion openstack 81.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmopenstack cloud 71.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmopenstack cloud 81.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmopenstack cloud crowbar 81.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise desktop 12 sp41.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 12 sp11.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 12 sp21.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 12 sp31.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise software development kit 12 sp41.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise software development kit 12 sp51.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp1-ltss1.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp2-ltss1.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp2-bcl1.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp3-ltss1.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp3-bcl1.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp41.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 12 sp41.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server 12 sp51.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 12 sp51.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Suselibssh2_orgrpmenterprise storage 51.4.3-20.14.1Not reportedSUSE-SU-2019:2936-1Not reported
Opensuselibssh2_orgrpmleap 15.21.9.0-lp152.8.3.1Not reportedOPENSUSE-SU-2020:2129-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15-espos1.8.0-4.10.1Not reportedSUSE-SU-2019:2900-2Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15-ltss1.8.0-4.10.1Not reportedSUSE-SU-2019:2900-2Not reported
Suselibssh2_orgrpmlinux enterprise server 15-ltss1.8.0-4.10.1Not reportedSUSE-SU-2019:2900-2Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 151.8.0-4.10.1Not reportedSUSE-SU-2019:2900-2Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.31.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.41.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.51.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise module for basesystem 15 sp41.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise module for basesystem 15 sp51.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp1-ltss1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp2-ltss1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp3-espos1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15 sp3-ltss1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp1-ltss1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp2-ltss1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15 sp3-ltss1.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 15 sp11.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 15 sp21.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 15 sp31.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmmanager proxy 4.21.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmmanager server 4.21.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.11.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise micro 5.21.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmenterprise storage 7.11.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Opensuselibssh2_orgrpmleap micro 5.31.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Opensuselibssh2_orgrpmleap micro 5.41.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Opensuselibssh2_orgrpmleap 15.41.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Opensuselibssh2_orgrpmleap 15.51.11.0-150000.4.19.1Not reportedSUSE-RU-2023:4192-1Not reported
Suselibssh2_orgrpmlinux enterprise module for basesystem 15 sp11.9.0-4.13.1Not reportedSUSE-SU-2020:3551-1Not reported
Suselibssh2_orgrpmlinux enterprise module for basesystem 15 sp21.9.0-4.13.1Not reportedSUSE-SU-2020:3551-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15-espos1.9.0-4.13.1Not reportedSUSE-SU-2020:3551-1Not reported
Suselibssh2_orgrpmlinux enterprise high performance computing 15-ltss1.9.0-4.13.1Not reportedSUSE-SU-2020:3551-1Not reported
Suselibssh2_orgrpmlinux enterprise server 15-ltss1.9.0-4.13.1Not reportedSUSE-SU-2020:3551-1Not reported
Suselibssh2_orgrpmlinux enterprise server for sap applications 151.9.0-4.13.1Not reportedSUSE-SU-2020:3551-1Not reported
Opensuselibssh2_orgrpmleap 15.11.8.0-lp151.6.3.1Not reportedOPENSUSE-SU-2019:2483-1Not reported
Opensuselibssh2_orgrpmleap 15.11.9.0-lp151.6.6.1Not reportedOPENSUSE-SU-2020:2126-1Not reported
Opensuselibssh2_orgrpmtumbleweed1.9.0-3.6Not reportedOPENSUSE-SU-2024:10999-1Not reported
Suselibssh2_orgrpmlinux enterprise module for basesystem 151.8.0-4.10.1Not reportedSUSE-SU-2019:2900-1Not reported
Suselibssh2_orgrpmlinux enterprise server 11 sp4-ltss1.4.3-17.12.1Not reportedSUSE-SU-2019:14206-1Not reported

[Debian bug #943562]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libssh2-1]Unknown

    Source package: [libssh2]

    Details (2)
    • 1.10.0-3+b1 · amd64 · bookworm

      Fixed · Fixed: 1.9.0-1

      dsa · libssh2 · debian · bookworm

    • 1.10.0-3+b1 · arm64 · bookworm

      Fixed · Fixed: 1.9.0-1

      dsa · libssh2 · debian · bookworm

  • [libssh2-1-dev]Unknown

    Source package: [libssh2]

    Details (2)
    • 1.10.0-3+b1 · amd64 · bookworm

      Fixed · Fixed: 1.9.0-1

      dsa · libssh2 · debian · bookworm

    • 1.10.0-3+b1 · arm64 · bookworm

      Fixed · Fixed: 1.9.0-1

      dsa · libssh2 · debian · bookworm

[openSUSE Tumbleweed]

  • [libssh2-1]Unknown

    Source package: [libssh2_org]

    Details (1)
    • 1.11.1-4.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.0-3.6

      Version impact unknown

      dsa · libssh2_org · opensuse · tumbleweed

  • Source package: [libssh2_org]

    Details (1)
    • 1.11.1-4.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.0-3.6

      Version impact unknown

      dsa · libssh2_org · opensuse · tumbleweed

  • [libssh2-devel]Unknown

    Source package: [libssh2_org]

    Details (1)
    • 1.11.1-4.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.9.0-3.6

      Version impact unknown

      dsa · libssh2_org · opensuse · tumbleweed

Observed:

References