REDHAT-BUG-1666119: Low severity openssh vulnerability
OpenSSH has a vulnerability in the scp client utility. Due to missing character encoding in the progress display, the object name can be used to manipulate the client output, for example to employ ANSI codes to hide additional files being transferred.
External Reference:
https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
Proposed Patch:
https://sintonen.fi/advisories/scp-name-validator.patch
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1666119?
The severity of REDHAT-BUG-1666119 is considered medium due to potential manipulation of the scp client output.
How do I fix REDHAT-BUG-1666119?
To fix REDHAT-BUG-1666119, update to the latest version of OpenSSH that addresses this vulnerability.
What products are affected by REDHAT-BUG-1666119?
The affected product in REDHAT-BUG-1666119 is the OpenSSH scp client utility.
Can REDHAT-BUG-1666119 be exploited remotely?
Yes, REDHAT-BUG-1666119 can be exploited remotely if an attacker controls the file names used in the scp command.
What methods can be used to mitigate REDHAT-BUG-1666119?
Mitigation for REDHAT-BUG-1666119 includes updating the software and applying best practices for file name validation.