CVE-2025-3360

What it actually does

Integer overflow and subsequent buffer under-read in g_date_time_new_from_iso8601 when handling long invalid ISO 8601 timestamps, resulting in limited denial-of-service conditions.

Why it matters to the business

Applications relying on the affected library may experience crashes or degraded availability when processing crafted timestamp input; the flaw affects a narrow set of Red Hat Enterprise Linux 7.5 compute node and server deployments with low overall operational risk.

How an attack unfolds

An attacker supplies a specially crafted, excessively long invalid ISO 8601 timestamp string to any code path invoking g_date_time_new_from_iso8601, triggering the integer overflow and buffer under-read to induce a crash.

How to fix it

Update libssh2 and related packages on Red Hat Enterprise Linux 7.5 systems to version 0:1.4.3-11.el7_5.1 or later for both compute node and server variants; rebuild or restart dependent services after installation.

How to confirm the fix worked

Query installed package versions with rpm or yum/dnf and confirm the presence of 1.4.3-11.el7_5.1 or newer; test timestamp parsing functions with known-bad inputs to verify absence of crashes.

Typical attack path

1. Identify an exposed interface or API that accepts ISO 8601 timestamp strings and passes them to g_date_time_new_from_iso8601
2. Craft a long, syntactically invalid timestamp that triggers integer overflow during length or value calculations
3. Submit the malicious timestamp over the network or via local input channels
4. Observe application crash or service interruption confirming the buffer under-read

How to detect it

Search application and system logs for crashes or segmentation faults occurring immediately after receipt of timestamp-formatted input; review process core dumps or stack traces referencing g_date_time_new_from_iso8601.

What your security team should do

• Apply the listed package updates to all affected RHEL 7.5 systems within standard change windows
• Review and inventory applications that call GLib date-time functions
• Monitor EPSS trend for any continued increase and reassess if exploit code appears