Alpaquita Linux
Security Advisory

CVE-2018-20685

Published: August 31, 2023Last modified: August 31, 2023

Description

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

Severity score breakdown

ParameterValue
Base score5.3
Attack VectorNETWORK
Attack complexityHIGH
Privileges requiredNONE
User interactionREQUIRED
ScopeUNCHANGED
ConfidentialityNONE
Integrity impactHIGH
Availability impactNONE
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Status

ProductReleasePackageStatus
Alpaquita Linux23 LTSopensshNot affected (9.1_p1-r5)
StreamopensshNot affected (9.4_p1-r0)

References

ON THIS PAGE