NetSight
IP …
high8.8

CVE-2019-14889

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8.

Impact

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

Affected products

VendorProductAffected versions
LibsshLibssh
before 0.8.8
from 0.9.0 before 0.9.3
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04, 19.10
OpensuseLeap
Version 15.1
FedoraprojectFedora
Versions 30, 31
DebianDebian Linux
Version 8.0
OracleMysql Workbench
through 8.0.19

Weakness classification

CWE-78

References