Fluid Attacks Database

Description

The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	libssh2	>=0 <1.4.3-4.1	1.4.3-4.1
nuget	libssh2-vc141_xp	>=0 <=1.4.3	1.8.2
debian 12	libssh2	>=0 <1.4.3-4.1	1.4.3-4.1
debian 14	libssh2	>=0 <1.4.3-4.1	1.4.3-4.1
debian 11	libssh2	>=0 <1.4.3-4.1	1.4.3-4.1
rpm rhel7	libssh2	<0:1.4.3-10.el7	0:1.4.3-10.el7
rpm rhel6	libssh2	-	-

Aliases

1. CVE-2015-17822. NVD-2015-17823. OSV-DEBIAN-2015-17824. OSV-2015-17825. GCVE-2015-17826. SECURITY-TRACKER-CVE-2015-1782

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.