In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-clientsUpgrade openssh-cavsUpgrade opensshUpgrade openssh-ldapUpgrade openssh-serverUpgrade pam_ssh_agent_auth | May 5, 2026 | May 4, 2026 |
| Alpine Linux | — | Upgrade dropbearUpgrade openssh | Jun 18, 2026 | Apr 2, 2026 |
| Amazon Linux Ami 2 | — | Upgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-debuginfoUpgrade openssh-cavsUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-keycat | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade openssh-serverUpgrade openssh-debugsourceUpgrade openssh-keycatUpgrade pam_ssh_agent_authUpgrade openssh-clients-debuginfoUpgrade opensshUpgrade openssh-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-keycat-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-clients | May 4, 2026 | Apr 2, 2026 |
| Debian | — | Upgrade openssh | May 17, 2026 | May 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory21 | May 31, 2026 | May 28, 2026 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jul 2, 2026 | Jul 1, 2026 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 10.3 | Apr 28, 2026 | Apr 2, 2026 |
| Oracle_linux | — | Upgrade opensshUpgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-ldapUpgrade openssh-keycatUpgrade openssh-keysignUpgrade openssh-clientsUpgrade pam_ssh_agent_authUpgrade openssh-server | May 6, 2026 | Apr 2, 2026 |
| Redhat Openshift | — | Upgrade rhcos | Aug 10, 2026 | Apr 2, 2026 |
| Redhat_linux | — | Upgrade opensshUpgrade openssh-keysign-debuginfoUpgrade openssh-server-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-server-sysvinitUpgrade openssh-debuginfoUpgrade openssh-keysignUpgrade openssh-clientsUpgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-cavsUpgrade openssh-keycatUpgrade openssh-askpass-debuginfoUpgrade openssh-keycat-debuginfoUpgrade openssh-debugsourceUpgrade openssh-serverUpgrade openssh-ldapUpgrade openssh-cavs-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-ldap-debuginfo | May 4, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade openssh-keycatUpgrade openssh-keycat-debuginfoUpgrade openssh-clients-debuginfoUpgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade openssh-server-debuginfoUpgrade openssh-clientsUpgrade openssh-askpass-debuginfoUpgrade openssh-serverUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-keysignUpgrade openssh-ldap-debuginfoUpgrade openssh-keysign-debuginfoUpgrade openssh-cavs-debuginfoUpgrade opensshUpgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-debuginfoUpgrade openssh-debugsource | May 11, 2026 | May 6, 2026 |
| Ubuntu | — | Upgrade openssh-server (Ubuntu Pro)Upgrade openssh-serverUpgrade openssh-clientUpgrade openssh-client (Ubuntu Pro) | Apr 29, 2026 | Apr 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub