CVE-2018-20685
- Source
- https://cve.org/CVERecord?id=CVE-2018-20685
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20685.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-20685
- Downstream
- Related
- Published
- 2019-01-10T21:29:00.377Z
- Modified
- 2026-07-08T16:40:33.885656Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
- Database specific
{ "unresolved_ranges": [ { "source": "CPE_RANGE", "vendor_product": "fujitsu:m10-1_firmware", "extracted_events": [ { "fixed": "xcp2361" }, { "fixed": "xcp3070" } ], "cpes": [ "cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "fujitsu:m10-4_firmware", "extracted_events": [ { "fixed": "xcp2361" }, { "fixed": "xcp3070" } ], "cpes": [ "cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "fujitsu:m10-4s_firmware", "extracted_events": [ { "fixed": "xcp2361" }, { "fixed": "xcp3070" }, { "fixed": "xcp3070" } ], "cpes": [ "cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "fujitsu:m12-1_firmware", "extracted_events": [ { "fixed": "xcp2361" }, { "fixed": "xcp3070" } ], "cpes": [ "cpe:2.3:o:fujitsu:m12-1_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "fujitsu:m12-2_firmware", "extracted_events": [ { "fixed": "xcp2361" }, { "fixed": "xcp3070" } ], "cpes": [ "cpe:2.3:o:fujitsu:m12-2_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "fujitsu:m12-2s_firmware", "extracted_events": [ { "fixed": "xcp2361" }, { "fixed": "xcp3070" } ], "cpes": [ "cpe:2.3:o:fujitsu:m12-2s_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "siemens:scalance_x204rna_eec_firmware", "extracted_events": [ { "fixed": "3.2.7" } ], "cpes": [ "cpe:2.3:o:siemens:scalance_x204rna_eec_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "siemens:scalance_x204rna_firmware", "extracted_events": [ { "fixed": "3.2.7" } ], "cpes": [ "cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_RANGE", "vendor_product": "winscp:winscp", "extracted_events": [ { "last_affected": "5.13" } ], "cpes": [ "cpe:2.3:a:winscp:winscp:*:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "canonical:ubuntu_linux", "extracted_events": [ { "introduced": "14.04" }, { "last_affected": "14.04" }, { "introduced": "16.04" }, { "last_affected": "16.04" }, { "introduced": "18.04" }, { "last_affected": "18.04" }, { "introduced": "18.10" }, { "last_affected": "18.10" } ], "cpes": [ "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "debian:debian_linux", "extracted_events": [ { "introduced": "8.0" }, { "last_affected": "8.0" }, { "introduced": "9.0" }, { "last_affected": "9.0" } ], "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "oracle:solaris", "extracted_events": [ { "introduced": "10" }, { "last_affected": "10" } ], "cpes": [ "cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux", "extracted_events": [ { "introduced": "7.0" }, { "last_affected": "7.0" }, { "introduced": "8.0" }, { "last_affected": "8.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_eus", "extracted_events": [ { "introduced": "8.1" }, { "last_affected": "8.1" }, { "introduced": "8.2" }, { "last_affected": "8.2" }, { "introduced": "8.4" }, { "last_affected": "8.4" }, { "introduced": "8.6" }, { "last_affected": "8.6" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_aus", "extracted_events": [ { "introduced": "8.2" }, { "last_affected": "8.2" }, { "introduced": "8.4" }, { "last_affected": "8.4" }, { "introduced": "8.6" }, { "last_affected": "8.6" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*" ] }, { "source": "CPE_STRING", "vendor_product": "redhat:enterprise_linux_server_tus", "extracted_events": [ { "introduced": "8.2" }, { "last_affected": "8.2" }, { "introduced": "8.4" }, { "last_affected": "8.4" }, { "introduced": "8.6" }, { "last_affected": "8.6" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*" ] } ] }- References
-
- http://www.securityfocus.com/bid/106531
- https://access.redhat.com/errata/RHSA-2019:3702
- https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
- https://security.gentoo.org/glsa/201903-16
- https://security.gentoo.org/glsa/202007-53
- https://security.netapp.com/advisory/ntap-20190215-0001/
- https://usn.ubuntu.com/3885-1/
- https://www.debian.org/security/2019/dsa-4387
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h
- https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2
- https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Affected packages
Git / github.com/openssh/openssh-portable
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssh/openssh-portable
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast affectedFixed
- Database specific
{ "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "last_affected": "7.9" } ] }
Affected versions
Other
ABOUT_TO_ADD_INET_ATON
AFTER_FREEBSD_PAM_MERGE
AFTER_KRB5_GSSAPI_MERGE
BEFORE_FREEBSD_PAM_MERGE
BEFORE_KRB5_GSSAPI_MERGE
POST_KRB4_REMOVAL
PRE-REORDER
PRE_CYGWIN_MERGE
PRE_DAN_PATCH_MERGE
PRE_FIXPATHS_INTEGRATION
PRE_HPUX_INTEGRATION
PRE_IPV6
PRE_KRB4_REMOVAL
PRE_NEW_LOGIN_CODE
PRE_SW_KRBV
V_1_2PRE17
V_1_2_1_PRE18
V_1_2_1_PRE19
V_1_2_1_PRE20
V_1_2_1_PRE21
V_1_2_1_PRE22
V_1_2_1_PRE23
V_1_2_1_PRE24
V_1_2_1_PRE25
V_1_2_1_PRE26
V_1_2_1_PRE27
V_1_2_2
V_1_2_2_P1
V_1_2_2_PRE28
V_1_2_2_PRE29
V_1_2_3
V_1_2_3_PRE1
V_1_2_3_PRE2
V_1_2_3_PRE3
V_1_2_3_PRE4
V_1_2_3_PRE5
V_1_2_3_TEST1
V_1_2_3_TEST2
V_1_2_3_TEST3
V_1_2_PRE10
V_1_2_PRE11
V_1_2_PRE12
V_1_2_PRE13
V_1_2_PRE14
V_1_2_PRE15
V_1_2_PRE16
V_1_2_PRE4
V_1_2_PRE5
V_1_2_PRE6
V_1_2_PRE7
V_1_2_PRE8
V_1_2_PRE9
V_2_0_0_BETA1
V_2_0_0_BETA2
V_2_0_0_TEST1
V_2_1_0
V_2_1_0_P1
V_2_1_0_P2
V_2_1_0_P3
V_2_1_1_P1
V_2_1_1_P2
V_2_1_1_P3
V_2_1_1_P4
V_2_2_0_P1
V_2_3_0_P1
V_2_5_0_P1
V_2_5_1_P1
V_2_5_1_P2
V_2_5_2_P1
V_3_0_1_P1
V_3_0_P1
V_3_1_P1
V_3_2_2_P1
V_3_4_P1
V_3_6_1_P1
V_3_8_P1
V_3_9_P1
V_4_2_P1
V_5_0_P1
V_5_1_P1
V_5_2_P1
V_5_5_P1
V_5_7_P1
V_6_0_P1
V_6_1_P1
V_6_2_P1
V_6_5_P1
V_6_6_P1
V_6_8_P1
V_6_9_P1
V_7_0_P1
V_7_1_P1
V_7_2_P1
V_7_3_P1
V_7_4_P1
V_7_5_P1
V_7_6_P1
V_7_7_P1
V_7_8_P1
V_7_9_P1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20685.json"
vanir_signatures
[
{
"id": "CVE-2018-20685-b442c2b5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"302129403808892202751107050716447255615",
"81754403452350988572066121963610991510",
"292440030647065191483533681366398077810",
"151193644289348312604596337242161711444",
"223618394384082972896881724008970952628"
]
},
"target": {
"file": "scp.c"
}
},
{
"id": "CVE-2018-20685-e7e06dcc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2",
"deprecated": false,
"digest": {
"function_hash": "284960368759419524838090916568148760402",
"length": 6783.0
},
"target": {
"function": "sink",
"file": "scp.c"
}
}
]
vanir_signatures_modified
"2026-07-08T16:40:33Z"