Threats affecting pkg:brew/libssh2

An out-of-bounds write vulnerability exists in libssh2 versions prior to 1.11.1_3 in the ssh2_transport_read() function due to lack of upper bounds enforcement on the packet_length field. This flaw allows remote attackers to send specially crafted SSH packets with excessively large packet_length values, leading to heap memory corruption and potential remote code execution. The issue is fixed in libssh2 version 1.11.1_3.

A pre-authentication denial of service (DoS) vulnerability exists in libssh2 through version 1.11.1_3. The flaw is in the SSH_MSG_EXT_INFO handler, where a malicious SSH server can send a crafted extension count value causing the client to enter a CPU exhaustion loop during key exchange. This results in the client spinning in a tight loop for over 60 seconds, leading to denial of service. The issue is fixed in libssh2 version 1.11.1_3.

A heap buffer over-read vulnerability exists in libssh2 through version 1.11.1_3 in the sftp_symlink() function. This flaw allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response with an invalid link_len value. The issue is fixed in version 1.11.1_3.