p PatchFirst

CVE-2018-20685

CVE-2018-20685

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

CVSS 5.3 · Medium · EPSS 3.7% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • openssh Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:7.9p1-5

    Update to 1:7.9p1-5

  • openssh Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:7.9p1-5

    Update to 1:7.9p1-5

  • openssh Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:7.9p1-5

    Update to 1:7.9p1-5

  • openssh Ubuntu:14.04:LTS

    Versions
    • 1:6.2p2-6
    • 1:6.2p2-6ubuntu1
    • 1:6.4p1-1
    • 1:6.4p1-2
    • 1:6.5p1-1
    • 1:6.5p1-2
    • 1:6.5p1-3
    • 1:6.5p1-4
    • 1:6.5p1-6
    • 1:6.6p1-1
    • 1:6.6p1-2
    • 1:6.6p1-2ubuntu1
    • 1:6.6p1-2ubuntu2
    • 1:6.6p1-2ubuntu2.2
    • 1:6.6p1-2ubuntu2.3
    • 1:6.6p1-2ubuntu2.4
    • 1:6.6p1-2ubuntu2.6
    • 1:6.6p1-2ubuntu2.7
    • 1:6.6p1-2ubuntu2.8
    • 1:6.6p1-2ubuntu2.10
    • 1:6.6p1-2ubuntu2.11
    Affected ranges
    • ECOSYSTEM: < 1:6.6p1-2ubuntu2.12

    Update to 1:6.6p1-2ubuntu2.12

  • openssh Ubuntu:16.04:LTS

    Versions
    • 1:6.9p1-2
    • 1:6.9p1-3
    • 1:7.1p1-1
    • 1:7.1p1-3
    • 1:7.1p1-4
    • 1:7.1p1-6
    • 1:7.1p2-1
    • 1:7.1p2-2
    • 1:7.2p1-1
    • 1:7.2p2-1
    • 1:7.2p2-2
    • 1:7.2p2-3
    • 1:7.2p2-4
    • 1:7.2p2-4ubuntu1
    • 1:7.2p2-4ubuntu2.1
    • 1:7.2p2-4ubuntu2.2
    • 1:7.2p2-4ubuntu2.4
    • 1:7.2p2-4ubuntu2.5
    • 1:7.2p2-4ubuntu2.6
    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-4ubuntu2.7

    Update to 1:7.2p2-4ubuntu2.7

  • openssh Ubuntu:Pro:FIPS-updates:16.04:LTS

    Versions
    • 1:7.2p2-4ubuntu2.fips.2.2.3
    • 1:7.2p2-4ubuntu2.fips.2.4.1
    • 1:7.2p2-4ubuntu2.fips.2.4.2
    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-4ubuntu2.fips.2.8.1

    Update to 1:7.2p2-4ubuntu2.fips.2.8.1

  • openssh Ubuntu:Pro:FIPS:16.04:LTS

    Versions
    • 1:7.2p2-4ubuntu2.fips.2.2
    • 1:7.2p2-4ubuntu2.fips.2.2.1
    Affected ranges
    • ECOSYSTEM: < 1:7.2p2-4ubuntu2.fips.2.10.1

    Update to 1:7.2p2-4ubuntu2.fips.2.10.1

  • openssh Ubuntu:18.04:LTS

    Versions
    • 1:7.5p1-10
    • 1:7.6p1-4
    • 1:7.6p1-4ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1:7.6p1-4ubuntu0.2

    Update to 1:7.6p1-4ubuntu0.2

  • openssh-ssh1 Ubuntu:18.04:LTS

    Versions
    • 1:7.5p1-8
    • 1:7.5p1-9
    • 1:7.5p1-9build1
    • 1:7.5p1-10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:20.04:LTS

    Versions
    • 1:7.5p1-11build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:22.04:LTS

    Versions
    • 1:7.5p1-12
    • 1:7.5p1-12build1
    • 1:7.5p1-13
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • openssh-ssh1 Ubuntu:24.04:LTS

    Versions
    • 1:7.5p1-14
    • 1:7.5p1-15
    • 1:7.5p1-15build1
    • 1:7.5p1-16
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →