CVE-2020-15778
Fixed in a distro release EPSS 14%CVSS 7.8
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Products: openbsd openssh, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | openssh | 8.0p1-24.el8 |
| AlmaLinux 8 | openssh-askpass | 8.0p1-24.el8 |
| AlmaLinux 8 | openssh-cavs | 8.0p1-24.el8 |
| AlmaLinux 8 | openssh-clients | 8.0p1-24.el8 |
| AlmaLinux 8 | openssh-keycat | 8.0p1-24.el8 |
| AlmaLinux 8 | openssh-ldap | 8.0p1-24.el8 |
| AlmaLinux 8 | openssh-server | 8.0p1-24.el8 |
| AlmaLinux 8 | pam_ssh_agent_auth | 0.10.3-7.24.el8 |
| Alpine 3.19 | openssh | 8.3_p1-r0 |
| Alpine 3.20 | openssh | 8.3_p1-r0 |
| Alpine 3.21 | openssh | 8.3_p1-r0 |
| Alpine 3.22 | openssh | 8.3_p1-r0 |
| Alpine 3.23 | openssh | 8.3_p1-r0 |
| Alpine 3.24 | openssh | 8.3_p1-r0 |
| Debian 12 | openssh | no fix |
| Debian 13 | openssh | no fix |
| Debian 14 | openssh | no fix |
| Red Hat Enterprise Linux 8 | openssh | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-askpass | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-askpass-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-cavs | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-cavs-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-clients | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-clients-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-debugsource | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-keycat | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-keycat-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-ldap | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-ldap-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-server | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | openssh-server-debuginfo | 0:8.0p1-24.el8 |
| Red Hat Enterprise Linux 8 | pam_ssh_agent_auth | 0:0.10.3-7.24.el8 |
| Red Hat Enterprise Linux 8 | pam_ssh_agent_auth-debuginfo | 0:0.10.3-7.24.el8 |
| Rocky Linux 8 | openssh | 0:8.0p1-24.el8 |
| Ubuntu 18.04 LTS | openssh-ssh1 | no fix |
| Ubuntu 20.04 LTS | openssh-ssh1 | no fix |
| Ubuntu Pro 14.04 LTS | openssh | no fix |
| Ubuntu Pro 16.04 LTS | openssh | no fix |
| Ubuntu Pro 18.04 LTS | openssh | no fix |
| Ubuntu Pro 20.04 LTS | openssh | no fix |