In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. T...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:14.04:LTS openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.12"}]}]

Ubuntu:16.04:LTS openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.7"}]}]

Ubuntu:Pro:FIPS-updates:16.04:LTS openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.fips.2.8.1"}]}]

Ubuntu:Pro:FIPS:16.04:LTS openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.fips.2.10.1"}]}]

Ubuntu:18.04:LTS openssh

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4ubuntu0.2"}]}]

Ubuntu:18.04:LTS openssh-ssh1

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:20.04:LTS openssh-ssh1

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:22.04:LTS openssh-ssh1

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:24.04:LTS openssh-ssh1

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

参照URL

advisory ubuntu.com
report ubuntu.com
report sintonen.fi
report lists.mindrot.org
report cve.org