LiveActive security incident?Get immediate response
CVE Record

CVE-2020-22218: An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of...

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2020-22218 is an out-of-bounds memory access issue in libssh2, reported against version 1.10.0. libssh2 is commonly embedded by software that implements SSH-related client functions. The public bundle does not provide CVSS, exploit evidence, or a complete affected-product list, so urgency should be based on asset exposure and vendor advisories.

Executive priority

Treat this as an inventory-and-patch item rather than a confirmed emergency. Prioritize internet-facing or business-critical systems that embed libssh2, and rely on vendor advisories because the public CVE data lacks severity and exploitability detail.

Technical view

The CVE describes an issue in libssh2 function _libssh2_packet_add that can allow attackers to access out-of-bounds memory. Public references include an upstream libssh2 pull request and downstream Debian LTS and NetApp advisories. The bundle does not include enough detail to confirm impact class, trigger conditions, or exploitability.

Likely exposure

Exposure is most likely in systems, applications, appliances, or OS packages that bundle libssh2 1.10.0 or affected downstream builds. Debian and NetApp advisories indicate downstream impact assessments exist, but the provided bundle does not enumerate all affected products or versions.

Exploitation context

There is no KEV listing and no cited source in the bundle states active exploitation. The available description is limited to out-of-bounds memory access in libssh2, without public exploit details or confirmed attack scenarios.

Researcher notes

Key gaps are missing CVSS, CWE, affected-version range, and trigger conditions. The upstream PR and downstream advisories should be reviewed for patch provenance and product applicability, but the provided bundle does not justify claims about code execution or active exploitation.

Mitigation direction

  • Inventory libssh2 versions across servers, applications, containers, and appliances.
  • Apply vendor or OS security updates that address CVE-2020-22218.
  • Use Debian DLA 3559-1 guidance where Debian LTS packages are in scope.
  • Review NetApp advisory NTAP-20231006-0002 for product-specific status.
  • Where guidance is absent, monitor the vendor before asserting remediation.

Validation and detection

  • Confirm whether assets use libssh2, especially version 1.10.0.
  • Check package manager, SBOM, and appliance advisory data for libssh2 presence.
  • Verify installed packages include the vendor fix for CVE-2020-22218.
  • Record systems depending on SSH/SFTP client functionality using libssh2.
  • Document unsupported or unclear vendor status as residual risk.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-22218 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.