CVE-2019-17498: Debian Linux

High severity, CVSS 8.1. EPSS: 3.8% chance of exploitation in the next 30 days.

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 30 only; version 31 only
• LIBSSH2 LIBSSH2: up to and including 1.9.0
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Bootstrap OS: affected versions not specified
• Netapp Element Software: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Opensuse Leap: version 15.1 only

Published 2019-10-21. Last modified 2026-06-17.