Описание
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | needed | |
| esm-infra-legacy/trusty | needs-triage | |
| esm-infra-legacy/xenial | needs-triage | |
| esm-infra/bionic | needs-triage | |
| esm-infra/focal | needs-triage | |
| fips-preview/jammy | needed | |
| fips-updates/bionic | needs-triage | |
| fips-updates/focal | needs-triage | |
| fips-updates/jammy | released | 1:8.9p1-3ubuntu0.16+Fips3 |
| fips-updates/noble | released | 1:9.6p1-3ubuntu13.18+Fips1 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | ignored | |
| esm-apps/bionic | ignored | |
| esm-apps/focal | ignored | |
| esm-apps/jammy | ignored | |
| esm-apps/noble | ignored | |
| esm-apps/resolute | ignored | |
| jammy | ignored | |
| noble | ignored | |
| questing | ignored | |
| resolute | ignored |
Показывать по
EPSS
4.2 Medium
CVSS3
Связанные уязвимости
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location o ...
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
EPSS
4.2 Medium
CVSS3