CVE-2020-15778: OS Command Injection
DISPUTED scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Other sources
OpenSSH could allow a remote attacker to execute arbitrary commands on the system, caused by improper input validation in the remote function in scp.c. By opening a specially crafted file containing backtick characters in the destination argument, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
— IBM
scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Reference: https://www.openssh.com/security.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-15778?
CVE-2020-15778 is a vulnerability in OpenSSH that could allow a remote attacker to execute arbitrary commands on the system.
What is the severity of CVE-2020-15778?
The severity of CVE-2020-15778 is high, with a severity value of 7.8.
How does CVE-2020-15778 work?
CVE-2020-15778 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.
What is the affected software?
The affected software includes OpenSSH version 8.3 and Netapp A700s Firmware.
How can I fix CVE-2020-15778?
To fix CVE-2020-15778, it is recommended to apply the necessary patches provided by the vendor.