CVE-2019-14889: OS Command Injection
A flaw was found with the libssh API function sshscpnew() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14889?
CVE-2019-14889 is a vulnerability found in the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, a user-provided path can execute a command on the server-side.
What is the severity of CVE-2019-14889?
The severity of CVE-2019-14889 is critical with a CVSS score of 8.8.
Which software versions are affected by CVE-2019-14889?
Versions before 0.9.3 and before 0.8.8 of libssh are affected. Additionally, Canonical Ubuntu Linux 16.04, 18.04, 19.04, 19.10, openSUSE Leap 15.1, Fedoraproject Fedora 30, 31, and Debian Debian Linux 8.0 are affected as well.
How can I fix CVE-2019-14889?
To fix CVE-2019-14889, users should update to version 0.9.3 or later of libssh.
Where can I find more information about CVE-2019-14889?
You can find more information about CVE-2019-14889 at the following references: [1](http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00033.html), [2](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00047.html), [3](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14889)