First published: Fri Jul 24 2020(Updated: )
** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
IBM Security Guardium Insights | <=2.0.2 | |
Openbsd Openssh | <8.3 | |
Openbsd Openssh | =8.3 | |
Openbsd Openssh | =8.3-p1 | |
Netapp A700s Firmware | ||
Netapp A700s | ||
Netapp Active Iq Unified Manager Vmware Vsphere | >=9.5 | |
Netapp Hci Management Node | ||
Netapp Solidfire | ||
Netapp Steelstore Cloud Integrated Storage | ||
Netapp Hci Compute Node | ||
Netapp Hci Storage Node | ||
Broadcom Fabric Operating System | ||
<8.3 | ||
=8.3 | ||
=8.3-p1 | ||
All of | ||
>=9.5 | ||
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-15778 is a vulnerability in OpenSSH that could allow a remote attacker to execute arbitrary commands on the system.
The severity of CVE-2020-15778 is high, with a severity value of 7.8.
CVE-2020-15778 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.
The affected software includes OpenSSH version 8.3 and Netapp A700s Firmware.
To fix CVE-2020-15778, it is recommended to apply the necessary patches provided by the vendor.