A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences.
This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libsshUpgrade libssh-configUpgrade libssh-devel | May 27, 2026 | May 19, 2026 |
| Alpine Linux | — | Upgrade libssh | Apr 13, 2026 | Mar 26, 2026 |
| Amazon_linux_2023 | — | Upgrade libssh-configUpgrade libssh-debugsourceUpgrade libsshUpgrade libssh-develUpgrade libssh-debuginfo | Mar 27, 2026 | Feb 10, 2026 |
| Debian | — | Upgrade libssh | Aug 3, 2026 | Aug 3, 2026 |
| Redhat_linux | — | Upgrade libsshNo solution existsUpgrade libssh-configUpgrade libssh-debugsourceUpgrade libssh-develUpgrade libssh-debuginfo | May 20, 2026 | Feb 10, 2026 |
| Rocky_linux | — | Upgrade libssh-develUpgrade libssh-debuginfoUpgrade libsshUpgrade libssh-debugsource | Jun 1, 2026 | May 28, 2026 |
| Suse | — | Upgrade libssh4-32bitUpgrade libssh-develUpgrade libssh-configUpgrade libssh4Upgrade libssh-devel-doc | Mar 4, 2026 | Feb 17, 2026 |
| Ubuntu | — | Upgrade libssh-4 (Ubuntu Pro)Upgrade libssh-4 | Feb 19, 2026 | Feb 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub