7.1
High
CVE-2019-14889 A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8
Description
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libssh | Versions not published |
References
- USN-4219-1 usn.ubuntu.com
- openSUSE-SU-2019:2689 lists.opensuse.org
- [debian-lts-announce] 20191217 [SECURITY] [DLA 2038-1] libssh security update lists.debian.org
- FEDORA-2019-8b0ad69829 lists.fedoraproject.org
- FEDORA-2019-46b6bd2459 lists.fedoraproject.org
- openSUSE-SU-2020:0102 lists.opensuse.org
- GLSA-202003-27 security.gentoo.org
- www.oracle.com www.oracle.com
- bugzilla.redhat.com bugzilla.redhat.com
- www.libssh.org www.libssh.org
- [debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update lists.debian.org
Timeline
- Published
- Last modified