The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensshUpgrade openssh-clientsUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-serverUpgrade openssh-ldap | May 31, 2024 | Jul 24, 2020 |
| Alpine Linux | — | Upgrade openssh | Dec 1, 2025 | Jul 24, 2020 |
| Debian | — | No solution exists | May 15, 2025 | Jul 24, 2020 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 23, 2020 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Dec 29, 2022 | Jul 24, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade opensshUpgrade openssh-cavsUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-clients | Jun 28, 2021 | Jul 24, 2020 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | Jul 31, 2020 | Jul 24, 2020 |
| Oracle_linux | — | Upgrade opensshUpgrade openssh-keycatUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-askpassUpgrade openssh-cavs | May 29, 2024 | Jul 18, 2020 |
| Redhat_linux | — | Upgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-cavs-debuginfoNo solution existsUpgrade openssh-askpass-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-serverUpgrade openssh-keycat-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-cavsUpgrade openssh-ldapUpgrade openssh-debugsourceUpgrade openssh-askpassUpgrade openssh-ldap-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-debuginfoUpgrade opensshUpgrade openssh-clients-debuginfo | May 23, 2024 | Jul 24, 2020 |
| Rocky_linux | — | Upgrade openssh-askpassUpgrade openssh-serverUpgrade openssh-keycat-debuginfoUpgrade openssh-debuginfoUpgrade openssh-cavsUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-ldap-debuginfoUpgrade openssh-ldapUpgrade openssh-keycatUpgrade opensshUpgrade openssh-debugsourceUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-askpass-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-cavs-debuginfo | May 8, 2025 | Jul 24, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub