The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssh | Jan 3, 2018 | Oct 26, 2017 |
| Amazon Linux Ami 2 | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-debuginfoUpgrade openssh-clientsUpgrade openssh-ldapUpgrade openssh-cavsUpgrade openssh-keycat | Apr 27, 2020 | Oct 26, 2017 |
| Amazon_linux | — | Upgrade openssh | May 11, 2018 | Oct 25, 2017 |
| Centos_linux | — | Upgrade openssh-serverUpgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade openssh-debuginfoUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade openssh-keycatUpgrade opensshUpgrade openssh-askpassUpgrade openssh-cavs | Aug 28, 2019 | Oct 26, 2017 |
| Debian | — | Upgrade openssh | Feb 25, 2019 | Oct 25, 2017 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jan 8, 2018 | Oct 25, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-clientsUpgrade openssh-askpassUpgrade opensshUpgrade openssh-serverUpgrade openssh-keycat | May 29, 2018 | Oct 25, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-server | May 29, 2018 | Oct 25, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory11 | Nov 30, 2017 | Oct 25, 2017 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.6 | Nov 17, 2017 | Oct 26, 2017 |
| Oracle Solaris | — | Upgrade network/ssh to version 7.7.0.1-11.4.6.0.1.2.0 on Solaris 11.4Upgrade service/network/ssh to version 7.7.0.1-11.4.6.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Oct 25, 2017 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-keycatUpgrade opensshUpgrade openssh-server-sysvinitUpgrade openssh-clientsUpgrade openssh-cavsUpgrade openssh-askpass | Apr 19, 2018 | Oct 3, 2017 |
| Redhat_linux | — | Upgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade openssh-debuginfoUpgrade opensshUpgrade openssh-cavsUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-ldapUpgrade openssh-clients | Apr 11, 2018 | Oct 25, 2017 |
| Suse | — | Upgrade openssh-askpass-gnomeUpgrade openssh-helpersUpgrade openssh-askpassUpgrade openssh-fipsUpgrade openssh-openssl1Upgrade opensshUpgrade openssh-openssl1-helpers | Dec 7, 2017 | Oct 25, 2017 |
| Ubuntu | — | Upgrade openssh-server | Jan 24, 2018 | Oct 25, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub