Remote command execution In openssh
Description
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | =1:10.0p1-1 || =1:10.0p1-2 || =1:10.0p1-3 || =1:10.0p1-4 || =1:10.0p1-5 || =1:10.0p1-5~bpo12+2 || =1:10.0p1-6 || =1:10.0p1-7 || =1:10.0p1-7~bpo12+1 || =1:10.0p1-8 || =1:10.1p1-1 || =1:10.1p1-2 || =1:10.2p1-1 || =1:10.2p1-2 || =1:10.2p1-2~bpo13+1 || =1:10.2p1-3 || =1:10.2p1-4 || =1:10.2p1-5 || =1:10.2p1-6 || =1:10.2p1-6~bpo13+1 || =1:10.3p1-1 || =1:9.2p1-2 || =1:9.2p1-2+deb12u1 || =1:9.2p1-2+deb12u2 || =1:9.2p1-2+deb12u3 || =1:9.2p1-2+deb12u4 || =1:9.2p1-2+deb12u5 || =1:9.2p1-2+deb12u6 || =1:9.2p1-2+deb12u7 || =1:9.2p1-2+deb12u8 || =1:9.2p1-2+deb12u9 || =1:9.3p1-1 || =1:9.3p1-1+loong64 || =1:9.3p2-1 || =1:9.4p1-1 || =1:9.5p1-1 || =1:9.5p1-2 || =1:9.6p1-1 || =1:9.6p1-2 || =1:9.6p1-3 || =1:9.6p1-4 || =1:9.6p1-5 || =1:9.7p1-1 || =1:9.7p1-2 || =1:9.7p1-3 || =1:9.7p1-3+hurd.1 || =1:9.7p1-4 || =1:9.7p1-5 || =1:9.7p1-6 || =1:9.7p1-7 || =1:9.8p1-1 || =1:9.8p1-2 || =1:9.8p1-3 || =1:9.8p1-4 || =1:9.8p1-7 || =1:9.8p1-8 || =1:9.9p1-1 || =1:9.9p1-2 || =1:9.9p1-3 || =1:9.9p1-3+hurd.1 || =1:9.9p2-1 || =1:9.9p2-2 | - | |
debian 11 | =1:10.0p1-1 || =1:10.0p1-2 || =1:10.0p1-3 || =1:10.0p1-4 || =1:10.0p1-5 || =1:10.0p1-5~bpo12+2 || =1:10.0p1-6 || =1:10.0p1-7 || =1:10.0p1-7~bpo12+1 || =1:10.0p1-8 || =1:10.1p1-1 || =1:10.1p1-2 || =1:10.2p1-1 || =1:10.2p1-2 || =1:10.2p1-2~bpo13+1 || =1:10.2p1-3 || =1:10.2p1-4 || =1:10.2p1-5 || =1:10.2p1-6 || =1:10.2p1-6~bpo13+1 || =1:10.3p1-1 || =1:8.4p1-5 || =1:8.4p1-5+deb11u1 || =1:8.4p1-5+deb11u2 || =1:8.4p1-5+deb11u3 || =1:8.4p1-5+deb11u4 || =1:8.4p1-5+deb11u5 || =1:8.4p1-5+deb11u6 || =1:8.4p1-6 || =1:8.7p1-1 || =1:8.7p1-2 || =1:8.7p1-3 || =1:8.7p1-4 || =1:8.8p1-1 || =1:8.9p1-1 || =1:8.9p1-2 || =1:8.9p1-3 || =1:9.0p1-1 || =1:9.1p1-1 || =1:9.1p1-2 || =1:9.2p1-1 || =1:9.2p1-2 || =1:9.3p1-1 || =1:9.3p1-1+loong64 || =1:9.3p2-1 || =1:9.4p1-1 || =1:9.5p1-1 || =1:9.5p1-2 || =1:9.6p1-1 || =1:9.6p1-2 || =1:9.6p1-3 || =1:9.6p1-4 || =1:9.6p1-5 || =1:9.7p1-1 || =1:9.7p1-2 || =1:9.7p1-3 || =1:9.7p1-3+hurd.1 || =1:9.7p1-4 || =1:9.7p1-5 || =1:9.7p1-6 || =1:9.7p1-7 || =1:9.8p1-1 || =1:9.8p1-2 || =1:9.8p1-3 || =1:9.8p1-4 || =1:9.8p1-7 || =1:9.8p1-8 || =1:9.9p1-1 || =1:9.9p1-2 || =1:9.9p1-3 || =1:9.9p1-3+hurd.1 || =1:9.9p2-1 || =1:9.9p2-2 | - | |
debian 13 | =1:10.0p1-7 || =1:10.0p1-7+deb13u1 || =1:10.0p1-7+deb13u2 || =1:10.0p1-8 || =1:10.1p1-1 || =1:10.1p1-2 || =1:10.2p1-1 || =1:10.2p1-2 || =1:10.2p1-2~bpo13+1 || =1:10.2p1-3 || =1:10.2p1-4 || =1:10.2p1-5 || =1:10.2p1-6 || =1:10.2p1-6~bpo13+1 || =1:10.3p1-1 | - | |
debian 14 | =1:10.0p1-7 || =1:10.0p1-8 || =1:10.1p1-1 || =1:10.1p1-2 || =1:10.2p1-1 || =1:10.2p1-2 || =1:10.2p1-2~bpo13+1 || =1:10.2p1-3 || =1:10.2p1-4 || =1:10.2p1-5 || =1:10.2p1-6 || =1:10.2p1-6~bpo13+1 || =1:10.3p1-1 | - | |
 alpine v3.19 | =5.1_p1-r1 || =5.1_p1-r2 || =5.1p1-r0 || =5.2_p1-r0 || =5.2_p1-r1 || =5.2_p1-r2 || =5.2_p1-r3 || =5.3_p1-r3 || =5.4_p1-r0 || =5.4_p1-r1 || =5.4_p1-r2 || =5.4_p1-r3 || =5.5_p1-r0 || =5.6_p1-r0 || =5.6_p1-r1 || =5.8_p1-r0 || =5.8_p1-r1 || =5.8_p1-r2 || =5.8_p2-r0 || =5.8_p2-r1 || =5.8_p2-r2 || =5.9_p1-r0 || =5.9_p1-r1 || =5.9_p1-r2 || =6.0_p1-r0 || =6.1_p1-r0 || =6.1_p1-r1 || =6.1_p1-r2 || =6.2_p1-r0 || =6.2_p2-r0 || =6.2_p2-r1 || =6.2_p2-r2 || =6.3_p1-r0 || =6.3_p1-r1 || =6.3_p1-r2 || =6.4_p1-r0 || =6.4_p1-r1 || =6.6_p1-r0 || =6.6_p1-r1 || =6.6_p1-r2 || =6.6_p1-r3 || =6.6_p1-r4 || =6.6_p1-r5 || =6.6_p1-r6 || =6.7_p1-r0 || =6.8_p1-r0 || =6.8_p1-r1 || =6.8_p1-r2 || =6.9_p1-r0 || =6.9_p1-r1 || =6.9_p1-r2 || =6.9_p1-r3 || =6.9_p1-r4 || =6.9_p1-r5 || =7.1_p1-r0 || =7.1_p1-r1 || =7.1_p2-r0 || =7.2_p1-r0 || =7.2_p2-r0 || =7.2_p2-r1 || =7.3_p1-r0 || =7.3_p1-r1 || =7.3_p1-r2 || =7.4_p1-r0 || =7.4_p1-r1 || =7.4_p1-r2 || =7.5_p1-r0 || =7.5_p1-r1 || =7.5_p1-r2 || =7.5_p1-r3 || =7.5_p1-r4 || =7.5_p1-r5 || =7.5_p1-r6 || =7.5_p1-r7 || =7.5_p1-r8 || =7.6_p1-r0 || =7.6_p1-r1 || =7.7_p1-r0 || =7.7_p1-r1 || =7.7_p1-r2 || =7.7_p1-r3 || =7.7_p1-r4 || =7.8_p1-r0 || =7.9_p1-r0 || =7.9_p1-r1 || =7.9_p1-r2 || =7.9_p1-r3 || =7.9_p1-r4 || =7.9_p1-r5 || =8.0_p1-r0 || =8.0_p1-r1 || =8.0_p1-r2 || =8.1_p1-r0 || =8.2_p1-r0 || >=0 <8.3_p1-r0 | 8.3_p1-r0 | |
alpine v3.22 | =5.1_p1-r1 || =5.1_p1-r2 || =5.1p1-r0 || =5.2_p1-r0 || =5.2_p1-r1 || =5.2_p1-r2 || =5.2_p1-r3 || =5.3_p1-r3 || =5.4_p1-r0 || =5.4_p1-r1 || =5.4_p1-r2 || =5.4_p1-r3 || =5.5_p1-r0 || =5.6_p1-r0 || =5.6_p1-r1 || =5.8_p1-r0 || =5.8_p1-r1 || =5.8_p1-r2 || =5.8_p2-r0 || =5.8_p2-r1 || =5.8_p2-r2 || =5.9_p1-r0 || =5.9_p1-r1 || =5.9_p1-r2 || =6.0_p1-r0 || =6.1_p1-r0 || =6.1_p1-r1 || =6.1_p1-r2 || =6.2_p1-r0 || =6.2_p2-r0 || =6.2_p2-r1 || =6.2_p2-r2 || =6.3_p1-r0 || =6.3_p1-r1 || =6.3_p1-r2 || =6.4_p1-r0 || =6.4_p1-r1 || =6.6_p1-r0 || =6.6_p1-r1 || =6.6_p1-r2 || =6.6_p1-r3 || =6.6_p1-r4 || =6.6_p1-r5 || =6.6_p1-r6 || =6.7_p1-r0 || =6.8_p1-r0 || =6.8_p1-r1 || =6.8_p1-r2 || =6.9_p1-r0 || =6.9_p1-r1 || =6.9_p1-r2 || =6.9_p1-r3 || =6.9_p1-r4 || =6.9_p1-r5 || =7.1_p1-r0 || =7.1_p1-r1 || =7.1_p2-r0 || =7.2_p1-r0 || =7.2_p2-r0 || =7.2_p2-r1 || =7.3_p1-r0 || =7.3_p1-r1 || =7.3_p1-r2 || =7.4_p1-r0 || =7.4_p1-r1 || =7.4_p1-r2 || =7.5_p1-r0 || =7.5_p1-r1 || =7.5_p1-r2 || =7.5_p1-r3 || =7.5_p1-r4 || =7.5_p1-r5 || =7.5_p1-r6 || =7.5_p1-r7 || =7.5_p1-r8 || =7.6_p1-r0 || =7.6_p1-r1 || =7.7_p1-r0 || =7.7_p1-r1 || =7.7_p1-r2 || =7.7_p1-r3 || =7.7_p1-r4 || =7.8_p1-r0 || =7.9_p1-r0 || =7.9_p1-r1 || =7.9_p1-r2 || =7.9_p1-r3 || =7.9_p1-r4 || =7.9_p1-r5 || =8.0_p1-r0 || =8.0_p1-r1 || =8.0_p1-r2 || =8.1_p1-r0 || =8.2_p1-r0 || >=0 <8.3_p1-r0 | 8.3_p1-r0 | |
alpine v3.20 | =5.1_p1-r1 || =5.1_p1-r2 || =5.1p1-r0 || =5.2_p1-r0 || =5.2_p1-r1 || =5.2_p1-r2 || =5.2_p1-r3 || =5.3_p1-r3 || =5.4_p1-r0 || =5.4_p1-r1 || =5.4_p1-r2 || =5.4_p1-r3 || =5.5_p1-r0 || =5.6_p1-r0 || =5.6_p1-r1 || =5.8_p1-r0 || =5.8_p1-r1 || =5.8_p1-r2 || =5.8_p2-r0 || =5.8_p2-r1 || =5.8_p2-r2 || =5.9_p1-r0 || =5.9_p1-r1 || =5.9_p1-r2 || =6.0_p1-r0 || =6.1_p1-r0 || =6.1_p1-r1 || =6.1_p1-r2 || =6.2_p1-r0 || =6.2_p2-r0 || =6.2_p2-r1 || =6.2_p2-r2 || =6.3_p1-r0 || =6.3_p1-r1 || =6.3_p1-r2 || =6.4_p1-r0 || =6.4_p1-r1 || =6.6_p1-r0 || =6.6_p1-r1 || =6.6_p1-r2 || =6.6_p1-r3 || =6.6_p1-r4 || =6.6_p1-r5 || =6.6_p1-r6 || =6.7_p1-r0 || =6.8_p1-r0 || =6.8_p1-r1 || =6.8_p1-r2 || =6.9_p1-r0 || =6.9_p1-r1 || =6.9_p1-r2 || =6.9_p1-r3 || =6.9_p1-r4 || =6.9_p1-r5 || =7.1_p1-r0 || =7.1_p1-r1 || =7.1_p2-r0 || =7.2_p1-r0 || =7.2_p2-r0 || =7.2_p2-r1 || =7.3_p1-r0 || =7.3_p1-r1 || =7.3_p1-r2 || =7.4_p1-r0 || =7.4_p1-r1 || =7.4_p1-r2 || =7.5_p1-r0 || =7.5_p1-r1 || =7.5_p1-r2 || =7.5_p1-r3 || =7.5_p1-r4 || =7.5_p1-r5 || =7.5_p1-r6 || =7.5_p1-r7 || =7.5_p1-r8 || =7.6_p1-r0 || =7.6_p1-r1 || =7.7_p1-r0 || =7.7_p1-r1 || =7.7_p1-r2 || =7.7_p1-r3 || =7.7_p1-r4 || =7.8_p1-r0 || =7.9_p1-r0 || =7.9_p1-r1 || =7.9_p1-r2 || =7.9_p1-r3 || =7.9_p1-r4 || =7.9_p1-r5 || =8.0_p1-r0 || =8.0_p1-r1 || =8.0_p1-r2 || =8.1_p1-r0 || =8.2_p1-r0 || >=0 <8.3_p1-r0 | 8.3_p1-r0 | |
alpine v3.23 | =5.1_p1-r1 || =5.1_p1-r2 || =5.1p1-r0 || =5.2_p1-r0 || =5.2_p1-r1 || =5.2_p1-r2 || =5.2_p1-r3 || =5.3_p1-r3 || =5.4_p1-r0 || =5.4_p1-r1 || =5.4_p1-r2 || =5.4_p1-r3 || =5.5_p1-r0 || =5.6_p1-r0 || =5.6_p1-r1 || =5.8_p1-r0 || =5.8_p1-r1 || =5.8_p1-r2 || =5.8_p2-r0 || =5.8_p2-r1 || =5.8_p2-r2 || =5.9_p1-r0 || =5.9_p1-r1 || =5.9_p1-r2 || =6.0_p1-r0 || =6.1_p1-r0 || =6.1_p1-r1 || =6.1_p1-r2 || =6.2_p1-r0 || =6.2_p2-r0 || =6.2_p2-r1 || =6.2_p2-r2 || =6.3_p1-r0 || =6.3_p1-r1 || =6.3_p1-r2 || =6.4_p1-r0 || =6.4_p1-r1 || =6.6_p1-r0 || =6.6_p1-r1 || =6.6_p1-r2 || =6.6_p1-r3 || =6.6_p1-r4 || =6.6_p1-r5 || =6.6_p1-r6 || =6.7_p1-r0 || =6.8_p1-r0 || =6.8_p1-r1 || =6.8_p1-r2 || =6.9_p1-r0 || =6.9_p1-r1 || =6.9_p1-r2 || =6.9_p1-r3 || =6.9_p1-r4 || =6.9_p1-r5 || =7.1_p1-r0 || =7.1_p1-r1 || =7.1_p2-r0 || =7.2_p1-r0 || =7.2_p2-r0 || =7.2_p2-r1 || =7.3_p1-r0 || =7.3_p1-r1 || =7.3_p1-r2 || =7.4_p1-r0 || =7.4_p1-r1 || =7.4_p1-r2 || =7.5_p1-r0 || =7.5_p1-r1 || =7.5_p1-r2 || =7.5_p1-r3 || =7.5_p1-r4 || =7.5_p1-r5 || =7.5_p1-r6 || =7.5_p1-r7 || =7.5_p1-r8 || =7.6_p1-r0 || =7.6_p1-r1 || =7.7_p1-r0 || =7.7_p1-r1 || =7.7_p1-r2 || =7.7_p1-r3 || =7.7_p1-r4 || =7.8_p1-r0 || =7.9_p1-r0 || =7.9_p1-r1 || =7.9_p1-r2 || =7.9_p1-r3 || =7.9_p1-r4 || =7.9_p1-r5 || =8.0_p1-r0 || =8.0_p1-r1 || =8.0_p1-r2 || =8.1_p1-r0 || =8.2_p1-r0 || >=0 <8.3_p1-r0 | 8.3_p1-r0 | |
alpine v3.21 | =5.1_p1-r1 || =5.1_p1-r2 || =5.1p1-r0 || =5.2_p1-r0 || =5.2_p1-r1 || =5.2_p1-r2 || =5.2_p1-r3 || =5.3_p1-r3 || =5.4_p1-r0 || =5.4_p1-r1 || =5.4_p1-r2 || =5.4_p1-r3 || =5.5_p1-r0 || =5.6_p1-r0 || =5.6_p1-r1 || =5.8_p1-r0 || =5.8_p1-r1 || =5.8_p1-r2 || =5.8_p2-r0 || =5.8_p2-r1 || =5.8_p2-r2 || =5.9_p1-r0 || =5.9_p1-r1 || =5.9_p1-r2 || =6.0_p1-r0 || =6.1_p1-r0 || =6.1_p1-r1 || =6.1_p1-r2 || =6.2_p1-r0 || =6.2_p2-r0 || =6.2_p2-r1 || =6.2_p2-r2 || =6.3_p1-r0 || =6.3_p1-r1 || =6.3_p1-r2 || =6.4_p1-r0 || =6.4_p1-r1 || =6.6_p1-r0 || =6.6_p1-r1 || =6.6_p1-r2 || =6.6_p1-r3 || =6.6_p1-r4 || =6.6_p1-r5 || =6.6_p1-r6 || =6.7_p1-r0 || =6.8_p1-r0 || =6.8_p1-r1 || =6.8_p1-r2 || =6.9_p1-r0 || =6.9_p1-r1 || =6.9_p1-r2 || =6.9_p1-r3 || =6.9_p1-r4 || =6.9_p1-r5 || =7.1_p1-r0 || =7.1_p1-r1 || =7.1_p2-r0 || =7.2_p1-r0 || =7.2_p2-r0 || =7.2_p2-r1 || =7.3_p1-r0 || =7.3_p1-r1 || =7.3_p1-r2 || =7.4_p1-r0 || =7.4_p1-r1 || =7.4_p1-r2 || =7.5_p1-r0 || =7.5_p1-r1 || =7.5_p1-r2 || =7.5_p1-r3 || =7.5_p1-r4 || =7.5_p1-r5 || =7.5_p1-r6 || =7.5_p1-r7 || =7.5_p1-r8 || =7.6_p1-r0 || =7.6_p1-r1 || =7.7_p1-r0 || =7.7_p1-r1 || =7.7_p1-r2 || =7.7_p1-r3 || =7.7_p1-r4 || =7.8_p1-r0 || =7.9_p1-r0 || =7.9_p1-r1 || =7.9_p1-r2 || =7.9_p1-r3 || =7.9_p1-r4 || =7.9_p1-r5 || =8.0_p1-r0 || =8.0_p1-r1 || =8.0_p1-r2 || =8.1_p1-r0 || =8.2_p1-r0 || >=0 <8.3_p1-r0 | 8.3_p1-r0 | |
 rpm rhel6 | - | - |
1-10 of 13
10
Aliases
References
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.