Description
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 11 | | | 0.9.3-1 |
debian 13 | | | 0.9.3-1 |
debian 14 | | | 0.9.3-1 |
debian 12 | | | 0.9.3-1 |
 alpine v3.8 | | =0.4.5-r0 || =0.4.6-r0 || =0.4.8-r0 || =0.5.0-r0 || =0.5.1-r0 || =0.5.2-r0 || =0.5.2-r1 || =0.5.3-r0 || =0.5.4-r0 || =0.5.5-r0 || =0.6.0-r0 || =0.6.3-r0 || =0.6.4-r0 || =0.6.5-r0 || =0.7.0-r0 || =0.7.1-r0 || =0.7.2-r0 || =0.7.3-r0 || =0.7.3-r1 || =0.7.4-r0 || =0.7.5-r0 || =0.7.5-r1 || =0.7.5-r2 || =0.7.5-r3 || =0.7.6-r0 || >=0 <0.7.6-r1 | 0.7.6-r1 |
alpine v3.10 | | =0.4.5-r0 || =0.4.6-r0 || =0.4.8-r0 || =0.5.0-r0 || =0.5.1-r0 || =0.5.2-r0 || =0.5.2-r1 || =0.5.3-r0 || =0.5.4-r0 || =0.5.5-r0 || =0.6.0-r0 || =0.6.3-r0 || =0.6.4-r0 || =0.6.5-r0 || =0.7.0-r0 || =0.7.1-r0 || =0.7.2-r0 || =0.7.3-r0 || =0.7.3-r1 || =0.7.4-r0 || =0.7.5-r0 || =0.7.5-r1 || =0.7.5-r2 || =0.7.5-r3 || =0.7.6-r0 || =0.7.6-r1 || >=0 <0.8.8-r0 | 0.8.8-r0 |
alpine v3.9 | | =0.4.5-r0 || =0.4.6-r0 || =0.4.8-r0 || =0.5.0-r0 || =0.5.1-r0 || =0.5.2-r0 || =0.5.2-r1 || =0.5.3-r0 || =0.5.4-r0 || =0.5.5-r0 || =0.6.0-r0 || =0.6.3-r0 || =0.6.4-r0 || =0.6.5-r0 || =0.7.0-r0 || =0.7.1-r0 || =0.7.2-r0 || =0.7.3-r0 || =0.7.3-r1 || =0.7.4-r0 || =0.7.5-r0 || =0.7.5-r1 || =0.7.5-r2 || =0.7.5-r3 || =0.7.6-r0 || =0.7.6-r1 || >=0 <0.7.6-r2 | 0.7.6-r2 |
alpine v3.11 | | =0.4.5-r0 || =0.4.6-r0 || =0.4.8-r0 || =0.5.0-r0 || =0.5.1-r0 || =0.5.2-r0 || =0.5.2-r1 || =0.5.3-r0 || =0.5.4-r0 || =0.5.5-r0 || =0.6.0-r0 || =0.6.3-r0 || =0.6.4-r0 || =0.6.5-r0 || =0.7.0-r0 || =0.7.1-r0 || =0.7.2-r0 || =0.7.3-r0 || =0.7.3-r1 || =0.7.4-r0 || =0.7.5-r0 || =0.7.5-r1 || =0.7.5-r2 || =0.7.5-r3 || =0.7.6-r0 || =0.7.6-r1 || =0.8.7-r0 || =0.9.0-r0 || =0.9.2-r0 || >=0 <0.9.3-r0 | 0.9.3-r0 |
 rpm rhel8 | | | 0:0.9.4-2.el8 |
