Description
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Broadcom / fabric_operating_system
- NetApp / a700s_firmware
- NetApp / active_iq_unified_manager9.5 –
- NetApp / hci_compute_node
- NetApp / hci_management_node
- NetApp / hci_storage_node
- NetApp / solidfire
- NetApp / steelstore_cloud_integrated_storage
- OpenBSD / OpenSSH8.3
- OpenBSD / OpenSSH8.3 – 8.3
- OpenBSD / OpenSSH8.3 – 8.3
References
- MISChttps://www.openssh.com/security.html
- MISChttps://github.com/cpandya2909/CVE-2020-15778/
- MISChttps://security.netapp.com/advisory/ntap-20200731-0007/
- MISChttps://news.ycombinator.com/item?id=25005567
- MISChttps://security.gentoo.org/glsa/202212-06
- VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2024:3166
Updated 45m ago · 8 sources