In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-keycatUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-askpass | May 5, 2026 | May 4, 2026 |
| Alpine Linux | — | Upgrade dropbearUpgrade openssh | Jun 18, 2026 | Apr 2, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssh-clientsUpgrade opensshUpgrade pam_ssh_agent_authUpgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-server-sysvinitUpgrade openssh-debuginfoUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-cavs | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade pam_ssh_agent_authUpgrade openssh-debugsourceUpgrade openssh-server-debuginfoUpgrade openssh-serverUpgrade openssh-keycat-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-debuginfoUpgrade openssh-keycatUpgrade opensshUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-clients | May 4, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade openssh | May 17, 2026 | May 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory21 | May 31, 2026 | May 28, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jul 1, 2026 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 10.3 | Apr 28, 2026 | Apr 2, 2026 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade openssh-cavsUpgrade opensshUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-keysignUpgrade openssh-askpass | May 6, 2026 | Apr 2, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Apr 2, 2026 |
| Redhat_linux | — | Upgrade openssh-keycatUpgrade openssh-debuginfoUpgrade openssh-cavsUpgrade pam_ssh_agent_authUpgrade openssh-keysignUpgrade openssh-server-debuginfoUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade openssh-keysign-debuginfoUpgrade openssh-askpassUpgrade openssh-clients-debuginfoUpgrade opensshUpgrade openssh-keycat-debuginfoUpgrade openssh-askpass-debuginfoUpgrade openssh-ldapUpgrade openssh-ldap-debuginfoUpgrade openssh-debugsourceUpgrade openssh-cavs-debuginfoUpgrade openssh-serverUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-sk-dummy-debuginfo | May 4, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-clients-debuginfoUpgrade openssh-keycat-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-server-debuginfoUpgrade openssh-cavsUpgrade openssh-askpass-debuginfoUpgrade openssh-askpassUpgrade openssh-debugsourceUpgrade opensshUpgrade openssh-ldap-debuginfoUpgrade openssh-keysignUpgrade openssh-serverUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keysign-debuginfoUpgrade openssh-cavs-debuginfoUpgrade openssh-debuginfo | May 11, 2026 | May 6, 2026 |
| Ubuntu | — | Upgrade openssh-clientUpgrade openssh-serverUpgrade openssh-server (Ubuntu Pro)Upgrade openssh-client (Ubuntu Pro) | Apr 29, 2026 | Apr 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub