« Volver al listado

CVE-2026-15370

Estado: AnalizadaAlta (7.3)—

A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS con AV:L y UI:R (requiere interacción del usuario/cliente) sugiere T1203. Overflow de buffer en libssh al listar directorios con nombres manipulados puede causar ejecución de código o DoS en el servidor SFTP.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationFilter Network TrafficExecution PreventionBehavior Prevention on Endpoint

Tecnologías afectadas (11)

Libssh — LibsshRedhat — Enterprise LinuxRedhat — Enterprise Linux FOR ELSRedhat — Enterprise Linux FOR EUSRedhat — Enterprise Linux FOR IBM Z SystemsRedhat — Enterprise Linux FOR IBM Z Systems ELSRedhat — Enterprise Linux FOR IBM Z Systems EUSRedhat — Enterprise Linux FOR Power Little EndianRedhat — Enterprise Linux FOR Power Little Endian ELSRedhat — Enterprise Linux FOR Power Little Endian EUSRedhat — Hardened Images

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-15370",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-15370",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-22T17:49:15.900169Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.2"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:0.12.0-3.el10_2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:hummingbird:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Hardened Images",
          "versions": [
            {
              "status": "unaffected",
              "version": "0.12.2-1.hum1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "libssh-main",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 8",
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "packageName": "libssh",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-21T09:16:53.683",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:47768",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:55855",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-15370",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499049",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server."
    }
  ],
  "lastModified": "2026-09-22T19:47:33.437",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AB6D376-A470-41DB-BEA0-77F711432B7A",
              "versionEndExcluding": "0.11.5",
              "versionStartIncluding": "0.11.0"
            },
            {
              "criteria": "cpe:2.3:a:libssh:libssh:0.12.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C250851D-1948-4012-ABE4-FEBB369E3231"
            },
            {
              "criteria": "cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87DEB507-5B64-47D7-9A50-3B87FD1E571F"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:arm64:*",
              "vulnerable": true,
              "matchCriteriaId": "63D81CCC-AECF-436A-B019-B3149585F92C"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "472208E5-9850-47CD-8C7D-E1EBF7FDB2C7"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:arm64:*",
              "vulnerable": true,
              "matchCriteriaId": "4DBA7603-2980-42BE-981C-FAE97568B00B"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.2:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "D28BC9F4-ECC6-411B-B445-B247FACD9530"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:arm64:*",
              "vulnerable": true,
              "matchCriteriaId": "C78AA720-6EBB-4CA7-8831-22A7CBFE7A1C"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_els:10.2:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "1D055CB8-FA3A-4DB8-AB58-9B17F7EC552B"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:arm64:*",
              "vulnerable": true,
              "matchCriteriaId": "ADFDF403-9B07-48CF-8BB2-11054879BCF8"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_eus:10.2:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "E7AB6D4F-D513-45F8-BC00-5F6C93D0002D"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31F91BA6-64D9-4248-8773-6B5B99CA01A0"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "157996FE-FC8B-4D4E-9538-E14BC0D8466F"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_els:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B8AC302-55C1-44FB-B66C-C6D0D6F5DBFE"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7F02954-7CB7-46F9-BBF1-3FAD6736F712"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06A3271F-112F-4FB7-A2F7-6401A365FCBA"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6F30042-532F-4A7C-897B-1084C0587957"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_els:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BB0DAF9-794A-4DAF-A4C6-3DDD8E42F48D"
            },
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDDCBC52-F003-4776-8D21-B525CF8D8B8D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}