CVE-2018-20685 In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the targ...
MediumCVSS 5.3
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssh(Debian:12) | < 1:7.9p1-5 | 1:7.9p1-5 |
| debian/openssh(Debian:13) | < 1:7.9p1-5 | 1:7.9p1-5 |
| debian/openssh(Debian:14) | < 1:7.9p1-5 | 1:7.9p1-5 |
| OpenBSD openssh | <= 7.9 | No fix listed |
| winscp | <= 5.13 | No fix listed |
| netapp cloud backup | All versions | No fix listed |
| netapp element software | All versions | No fix listed |
| netapp ontap select deploy | All versions | No fix listed |
| netapp steelstore cloud integrated storage | All versions | No fix listed |
| netapp storage automation store | All versions | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.10 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux | = 8.0 | No fix listed |
| redhat enterprise linux eus | = 8.1 | No fix listed |
| redhat enterprise linux eus | = 8.2 | No fix listed |
| redhat enterprise linux eus | = 8.4 | No fix listed |
| redhat enterprise linux eus | = 8.6 | No fix listed |
| redhat enterprise linux server aus | = 8.2 | No fix listed |
| redhat enterprise linux server aus | = 8.4 | No fix listed |
| redhat enterprise linux server aus | = 8.6 | No fix listed |
Show 55 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server tus | = 8.2 | No fix listed |
| redhat enterprise linux server tus | = 8.4 | No fix listed |
| redhat enterprise linux server tus | = 8.6 | No fix listed |
| oracle solaris | = 10 | No fix listed |
| fujitsu m10-1 firmware | < xcp2361 | xcp2361 |
| fujitsu m10-1 firmware | < xcp3070 | xcp3070 |
| fujitsu m10-4 firmware | < xcp2361 | xcp2361 |
| fujitsu m10-4 firmware | < xcp3070 | xcp3070 |
| fujitsu m10-4s firmware | < xcp2361 | xcp2361 |
| fujitsu m10-4s firmware | < xcp3070 | xcp3070 |
| fujitsu m12-1 firmware | < xcp2361 | xcp2361 |
| fujitsu m12-1 firmware | < xcp3070 | xcp3070 |
| fujitsu m12-2 firmware | < xcp2361 | xcp2361 |
| fujitsu m12-2 firmware | < xcp3070 | xcp3070 |
| fujitsu m12-2s firmware | < xcp2361 | xcp2361 |
| fujitsu m12-2s firmware | < xcp3070 | xcp3070 |
| Siemens scalance x204rna firmware | < 3.2.7 | 3.2.7 |
| Siemens scalance x204rna eec firmware | < 3.2.7 | 3.2.7 |
| alpine/dropbear(Alpine:v3.10) | < 2019.78-r1 | 2019.78-r1 |
| alpine/dropbear(Alpine:v3.11) | < 2019.78-r1 | 2019.78-r1 |
| alpine/dropbear(Alpine:v3.12) | < 2019.78-r1 | 2019.78-r1 |
| alpine/dropbear(Alpine:v3.13) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.14) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.15) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.16) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.17) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.18) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.19) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.20) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.21) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.22) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.23) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.24) | < 2020.79-r0 | 2020.79-r0 |
| alpine/dropbear(Alpine:v3.9) | < 2018.76-r3 | 2018.76-r3 |
| alpine/openssh(Alpine:v3.10) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.11) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.12) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.13) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.14) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.15) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.16) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.17) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.18) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.19) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.20) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.21) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.22) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.23) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.24) | < 7.9_p1-r3 | 7.9_p1-r3 |
| alpine/openssh(Alpine:v3.6) | < 7.5_p1-r4 | 7.5_p1-r4 |
| alpine/openssh(Alpine:v3.7) | < 7.5_p1-r10 | 7.5_p1-r10 |
| alpine/openssh(Alpine:v3.8) | < 7.7_p1-r4 | 7.7_p1-r4 |
| alpine/openssh(Alpine:v3.9) | < 7.9_p1-r3 | 7.9_p1-r3 |
| ubuntu/openssh-ssh1(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/openssh-ssh1(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3885-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2018-20685 vendor-advisory
- 106531 broken-link vdb-entry
- RHSA-2019:3702 third-party-advisory vendor-advisory
- cert-portal.siemens.com patch third-party-advisory
- cvsweb.openbsd.org patch
- github.com patch
- [debian-lts-announce] 20190325 [SECURITY] [DLA 1728-1] openssh security update mailing-list third-party-advisory
- GLSA-201903-16 third-party-advisory vendor-advisory
- GLSA-202007-53 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- sintonen.fi patch third-party-advisory
- USN-3885-1 third-party-advisory vendor-advisory
- DSA-4387 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking