CVE-2020-22218

Q: What is CVE-2020-22218?

CVE-2020-22218 is a vulnerability in libssh2 1.10.0 that allows attackers to access out-of-bounds memory.

Q: How severe is CVE-2020-22218?

CVE-2020-22218 has a severity rating of 7.5 (high).

Q: What software versions are affected by CVE-2020-22218?

CVE-2020-22218 affects libssh2 1.10.0, ubuntu/libssh2 1.4.3-2ubuntu0.2+, ubuntu/libssh2 1.5.0-2ubuntu0.1+, ubuntu/libssh2 1.8.0-1ubuntu0.1, ubuntu/libssh2 1.8.0-2.1ubuntu0.1, and debian/libssh2 1.8.0-2.1+deb10u1, 1.10.0-3, and 1.11.0-2.

Q: How can I fix CVE-2020-22218?

To fix CVE-2020-22218, update to a version of libssh2 that is not affected by the vulnerability.

Q: Where can I find more information about CVE-2020-22218?

You can find more information about CVE-2020-22218 at the following references: [GitHub](https://github.com/libssh2/libssh2/pull/476), [Debian LTS](https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html), [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22218).

Published Aug 22, 2023

Updated

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

Affected Software

15 affected componentsFixes available

redhat/libssh2<1.10.0

1.10.0

redhat/libssh2<1.11.0

1.11.0

ubuntu/libssh2<1.8.0-1ubuntu0.1

1.8.0-1ubuntu0.1

ubuntu/libssh2<1.8.0-2.1ubuntu0.1

1.8.0-2.1ubuntu0.1

ubuntu/libssh2<1.4.3-2ubuntu0.2+

1.4.3-2ubuntu0.2+

ubuntu/libssh2<1.5.0-2ubuntu0.1+

1.5.0-2ubuntu0.1+

debian/libssh2<=1.8.0-2.1, <=1.9.0-2

1.8.0-2.1+deb10u11.10.0-31.11.0-4

libssh2 libssh2=1.10.0

IBM QRadar SIEM<=7.5 - 7.5.0 UP7

F5 BIG-IP>=17.1.0<=17.1.2

17.1.2.2

F5 BIG-IP>=16.1.0<=16.1.6

F5 BIG-IP>=15.1.0<=15.1.10

F5 BIG-IQ Centralized Management>=8.0.0<=8.4.0

8.4.1

F5 F5OS-A=1.5.0, =1.4.0, >=1.3.0<=1.3.2

1.7.01.5.2

F5 F5OS-C=1.6.0, >=1.5.0<=1.5.1

1.8.0

Remediation

Patch Available

https://github.com/libssh2/libssh2/pull/476

Patch Available

https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df

Event History

Aug 22, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Jan 11, 2024

Data Sourced

via Launchpad·11:45 PM

Description

Jan 13, 2024

Advisory Published

via F5·12:06 AM

Data Sourced

via F5·12:06 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2020-22218?

CVE-2020-22218 is a vulnerability in libssh2 1.10.0 that allows attackers to access out-of-bounds memory.

How severe is CVE-2020-22218?

CVE-2020-22218 has a severity rating of 7.5 (high).

What software versions are affected by CVE-2020-22218?

CVE-2020-22218 affects libssh2 1.10.0, ubuntu/libssh2 1.4.3-2ubuntu0.2+, ubuntu/libssh2 1.5.0-2ubuntu0.1+, ubuntu/libssh2 1.8.0-1ubuntu0.1, ubuntu/libssh2 1.8.0-2.1ubuntu0.1, and debian/libssh2 1.8.0-2.1+deb10u1, 1.10.0-3, and 1.11.0-2.

How can I fix CVE-2020-22218?

To fix CVE-2020-22218, update to a version of libssh2 that is not affected by the vulnerability.

Where can I find more information about CVE-2020-22218?

You can find more information about CVE-2020-22218 at the following references: [GitHub](https://github.com/libssh2/libssh2/pull/476), [Debian LTS](https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html), [CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-22218).

CVE-2020-22218

Affected Software

Remediation

Patch Available

Patch Available

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2020-22218?

How severe is CVE-2020-22218?

What software versions are affected by CVE-2020-22218?

How can I fix CVE-2020-22218?

Where can I find more information about CVE-2020-22218?

Company

Resources

Contact