Описание
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1:10.5p1-1ubuntu2 |
| esm-infra-legacy/trusty | released | 1:6.6p1-2ubuntu2.13+esm4 |
| esm-infra-legacy/xenial | released | 1:7.2p2-4ubuntu2.10+esm10 |
| esm-infra/bionic | released | 1:7.6p1-4ubuntu0.7+esm6 |
| esm-infra/focal | released | 1:8.2p1-4ubuntu0.13+esm3 |
| fips-preview/jammy | needed | |
| fips-updates/bionic | needs-triage | |
| fips-updates/focal | needs-triage | |
| fips-updates/jammy | released | 1:8.9p1-3ubuntu0.16+Fips3 |
| fips-updates/noble | released | 1:9.6p1-3ubuntu13.18+Fips1 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | ignored | |
| esm-apps/bionic | ignored | |
| esm-apps/focal | ignored | |
| esm-apps/jammy | ignored | |
| esm-apps/noble | ignored | |
| esm-apps/resolute | ignored | |
| jammy | ignored | |
| noble | ignored | |
| questing | ignored | |
| resolute | ignored |
Показывать по
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
sftp in OpenSSH before 10.4 does not properly constrain the location o ...
sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.
EPSS
5.4 Medium
CVSS3