The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openssh | Jan 3, 2018 | Oct 26, 2017 |
| Amazon Linux Ami 2 | — | Upgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-server-sysvinitUpgrade opensshUpgrade openssh-keycatUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-clientsUpgrade openssh-cavsUpgrade openssh-debuginfo | Apr 27, 2020 | Oct 26, 2017 |
| Amazon_linux | — | Upgrade openssh | May 11, 2018 | Oct 25, 2017 |
| Centos_linux | — | Upgrade openssh-serverUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade opensshUpgrade openssh-server-sysvinitUpgrade openssh-keycatUpgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-clientsUpgrade openssh-debuginfo | Aug 28, 2019 | Oct 26, 2017 |
| Debian | — | Upgrade openssh | Feb 25, 2019 | Oct 25, 2017 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Jan 8, 2018 | Oct 25, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-serverUpgrade openssh-clientsUpgrade openssh-keycat | May 29, 2018 | Oct 25, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssh-askpassUpgrade opensshUpgrade openssh-serverUpgrade openssh-clientsUpgrade openssh-keycat | May 29, 2018 | Oct 25, 2017 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory11 | Nov 30, 2017 | Oct 25, 2017 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 7.6 | Nov 17, 2017 | Oct 26, 2017 |
| Oracle Solaris | — | Upgrade service/network/ssh to version 7.7.0.1-11.4.6.0.1.2.0 on Solaris 11.4Upgrade network/ssh to version 7.7.0.1-11.4.6.0.1.2.0 on Solaris 11.4 | Feb 20, 2019 | Oct 25, 2017 |
| Oracle_linux | — | Upgrade openssh-serverUpgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-server-sysvinitUpgrade openssh-cavsUpgrade opensshUpgrade openssh-askpassUpgrade openssh-clients | Apr 19, 2018 | Oct 3, 2017 |
| Redhat_linux | — | Upgrade opensshUpgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-debuginfoUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh-keycatUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-clients | Apr 11, 2018 | Oct 25, 2017 |
| Suse | — | Upgrade opensshUpgrade openssh-openssl1-helpersUpgrade openssh-openssl1Upgrade openssh-fipsUpgrade openssh-askpass-gnomeUpgrade openssh-helpersUpgrade openssh-askpass | Dec 7, 2017 | Oct 25, 2017 |
| Ubuntu | — | Upgrade openssh-server | Jan 24, 2018 | Oct 25, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 26, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub