There’s a vulnerability in the libssh package where an unexpectedly large input buffer passed to the ssh_get_fingerprint_hash() function can lead to an integer overflow in the bin_to_base64() function. This results in memory under allocation, potentially causing out of bounds writes and heap corruption. This issue specifically affects 32-bit builds of libssh.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.5 | CVE-2025-4877 |
Exploitation
To exploit this vulnerability, an attacker would need to provide an unexpectedly large input buffer to the ssh_get_fingerprint_hash() function in a libssh consumer application. This could lead to an integer overflow and subsequent heap corruption, allowing the attacker to potentially execute arbitrary code or crash the application.
Affected Products
- libssh: A library for implementing the SSH protocol, specifically vulnerable in its 32-bit builds.
Mitigation
To mitigate this vulnerability, it is recommended to update the libssh package to the latest version that addresses this issue. Additionally, users should validate input sizes to prevent unexpected large buffers from being processed.