high7.4
CVE-2020-15778
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.
Impact
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openbsd | Openssh | before 8.3 Version 8.3 |
| Netapp | A700s Firmware | All versions |
| Netapp | Active Iq Unified Manager | from 9.5 |
| Netapp | Hci Management Node | All versions |
| Netapp | Solidfire | All versions |
| Netapp | Steelstore Cloud Integrated Storage | All versions |
| Netapp | Hci Compute Node | All versions |
| Netapp | Hci Storage Node | All versions |
| Broadcom | Fabric Operating System | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2024:3166
- https://github.com/cpandya2909/CVE-2020-15778/
- https://news.ycombinator.com/item?id=25005567
- https://security.gentoo.org/glsa/202212-06
- https://security.netapp.com/advisory/ntap-20200731-0007/
- https://www.openssh.com/security.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html