CVE-2019-3863

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2019
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38648.8A vulnerability was discovered in all quay-2 versions before quay-3.0.0, in the Quay web GUI where POST requests include a specific paramete CVE-2019-38656.1A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able CVE-2019-38665.5An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were m CVE-2019-38674.1A vulnerability was found in the Quay web application. Sessions in the Quay web application never expire. An attacker, able to gain access t CVE-2019-38683.8Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OI CVE-2019-38697.2When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variabl CVE-2019-38706.1A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD D CVE-2019-38718.8A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the CVE-2019-38725.4It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x an CVE-2019-38739.0It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XM CVE-2019-38746.5The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a d CVE-2019-38754.8A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL