Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2019-6111

openssh: Improper validation of object names allows malicious server to overwrite files via scp client

An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).

CVSS 3.1 · 5.9 Medium EPSS 58.2% KEV · Not listed
Vendors
Apache Canonical Debian and 7 more
Products
Mina Sshd Ubuntu Linux Debian Linux and 24 more
CVE-2019-6110

openssh: Acceptance and display of arbitrary stderr allows for spoofing of scp client output

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

CVSS 3.1 · 6.8 Medium EPSS 24.9% KEV · Not listed
Vendors
Netapp Openbsd Siemens and 1 more
Products
Element Software Ontap Select Deploy Storage Automation Store and 6 more
CVE-2019-6109

openssh: Missing character encoding in progress display allows for spoofing of scp client output

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.

CVSS 3.1 · 6.8 Medium EPSS 3.8% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 6 more
Products
Ubuntu Linux Debian Linux Fedora and 25 more
CVE-2018-20685

openssh: scp client improper directory name validation

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

CVSS 3.1 · 5.3 Medium EPSS 3.7% KEV · Not listed
Vendors
Canonical Debian Fujitsu and 6 more
Products
Ubuntu Linux Debian Linux M10-1 and 27 more