A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libssh-develUpgrade libssh-configUpgrade libssh | May 4, 2022 | Dec 10, 2019 |
| Alpine Linux | — | Upgrade libssh | Dec 27, 2019 | Dec 10, 2019 |
| Centos_linux | — | Upgrade libssh-debuginfoUpgrade libsshUpgrade libssh-develUpgrade libssh-configUpgrade libssh-debugsource | Nov 5, 2020 | Dec 10, 2019 |
| Debian | — | Upgrade libssh | Dec 19, 2019 | Dec 10, 2019 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Freebsd | — | Upgrade libssh | Feb 3, 2020 | Feb 2, 2020 |
| Gentoo Linux | — | Upgrade net-libs/libssh. | Mar 16, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade libssh2 | Apr 16, 2020 | Dec 10, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libssh | Feb 26, 2020 | Dec 10, 2019 |
| Oracle_linux | — | Upgrade libssh-configUpgrade libsshUpgrade libssh-devel | Nov 13, 2020 | Dec 5, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Mar 12, 2021 | Dec 10, 2019 |
| Redhat_linux | — | Upgrade libssh-configUpgrade libssh-debuginfoUpgrade libsshUpgrade libssh-debugsourceUpgrade libssh-devel | Nov 5, 2020 | Dec 10, 2019 |
| Rocky_linux | — | Upgrade libssh-debugsourceUpgrade libssh-debuginfoUpgrade libssh-develUpgrade libssh | Mar 12, 2024 | Dec 10, 2019 |
| Suse | — | Upgrade libssh-develUpgrade libssh-devel-docUpgrade libssh4-32bitUpgrade libssh4 | Dec 17, 2019 | Dec 10, 2019 |
| Ubuntu | — | Upgrade libssh-4 | Dec 11, 2019 | Dec 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub