A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
10/12/2019
by Libssh
4 months ago
by Oracle
2 years ago
by Fedoraproject
a month ago
by Debian
2 months ago
by Canonical
4 months ago
by Opensuse
7 months ago