CVE-2017-15906

Fixed in a distro release EPSS 3%CVSS 5.3

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

Published 2017-10-26 · CVE record · OSV

Products: openbsd openssh, oracle sun_zfs_storage_appliance_kit, debian_linux, netapp active_iq_unified_manager, netapp cloud_backup, netapp clustered_data_ontap, netapp data_ontap_edge, netapp hci_management_node, netapp oncommand_unified_manager_core_package, netapp solidfire, netapp steelstore_cloud_integrated_storage, netapp storage_replication_adapter_for_clustered_data_ontap, netapp vasa_provider_for_clustered_data_ontap, netapp virtual_storage_console, netapp cn1610_firmware, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation

Distro releases