CVE-2018-20685
Publication date 10 January 2019
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
Status
Package | Ubuntu Release | Status |
---|---|---|
openssh | 24.04 LTS noble |
Fixed 1:7.9p1-5
|
22.04 LTS jammy |
Fixed 1:7.9p1-5
|
|
20.04 LTS focal |
Fixed 1:7.9p1-5
|
|
18.04 LTS bionic |
Fixed 1:7.6p1-4ubuntu0.2
|
|
16.04 LTS xenial |
Fixed 1:7.2p2-4ubuntu2.7
|
|
14.04 LTS trusty |
Fixed 1:6.6p1-2ubuntu2.12
|
|
openssh-ssh1 | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release |
Notes
seth-arnold
openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment.
mdeslaur
The recommended workaround for this issue is to switch to using sftp instead of scp.
Patch details
Package | Patch details |
---|---|
openssh |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.3 · Medium |
Attack vector | Network |
Attack complexity | High |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-3885-1
- OpenSSH vulnerabilities
- 7 February 2019