libssh2-1.8.0-3.el7

The libssh2 packages provide a library that implements the SSH2 protocol.

The following packages have been upgraded to a later upstream version: libssh2 (1.8.0). (BZ#1592784)

Security Fix(es):

* libssh2: Zero-byte allocation with a specially crafted SFTP packed leading to an out-of-bounds read (CVE-2019-3858)

* libssh2: Out-of-bounds reads with specially crafted SSH packets (CVE-2019-3861)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2019-3858
An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a specially crafted SFTP packet is received from the server. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.
CVE-2019-3861
An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH packets with a padding length value greater than the packet length are parsed. A remote attacker who compromises a SSH server may be able to cause a Denial of Service or read data in the client memory.