CVE-2019-14889
High
Description
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Libssh
PublishedDec 10, 2019
First seenDec 10, 2019
Weakness typeCWE-78OS command injection
How to fix
Update
- libssh libssh0.8.8, 0.9.3 or later
Vendor advisories
- usn.ubuntu.com/4219-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7JJWJTXVWLLJTVHBPGWL7472S5FWXYQR/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EV2ONSPDJCTDVORCB4UGRQUZQQ46JHRN/
- security.gentoo.org/glsa/202003-27
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libssh libssh | v < 0.8.8, 0.9.0 ≤ v < 0.9.3 | 0.8.8, 0.9.3 |
| canonical ubuntu_linux | 16.04, 18.04, 19.04, 19.10 | — |
| opensuse leap | 15.1 | — |
| fedoraproject fedora | 30, 31 | — |
| debian debian_linux | 8.0 | — |
| oracle mysql_workbench | v ≤ 8.0.19 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.