CVE-2020-15778

HIGH · 7.4 CVSS Gepubliceerd: 24-07-2020 CWE-78

Beschrijving

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Vendors

Openbsd Netapp Broadcom

Affected products

Openssh A700s Firmware A700s Active Iq Unified Manager Hci Management Node Solidfire Steelstore Cloud Integrated Storage Hci Compute Node Hci Storage Node Fabric Operating System

References

access.redhat.com
github.com
news.ycombinator.com
security.gentoo.org
security.netapp.com
www.openssh.com
cert-portal.siemens.com