CVE-2019-3856

Name of the Vulnerable Software and Affected Versions libssh2 versions prior to 1.8.1

Description The issue is related to an integer overflow in the libssh2 library, specifically in the way keyboard prompt requests are parsed. This could allow a remote attacker who compromises an SSH server to execute arbitrary code on the client system when a user connects to the server. The vulnerability is associated with the userauth keyboard interactive() function in the userauth.c component of the libssh2 library.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider disabling the userauth keyboard interactive() function until a patch is available.