Vulnerability · Published Jul 24, 2020 · Assigned by mitre
CVE-2020-15778
High 7.8
In plain English
A high-severity OS command injection in the openssh package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 13.7% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | openssh | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | openssh-askpass | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | openssh-cavs | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | openssh-clients | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | openssh-keycat | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | openssh-ldap | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | openssh-server | 8.0p1-24.el8 | ALSA-2024:3166 |
| AlmaLinux:8 | pam_ssh_agent_auth | 0.10.3-7.24.el8 | ALSA-2024:3166 |
| Alpine:v3.20 | openssh | 8.3_p1-r0 | ALPINE-CVE-2020-15778 |
| Alpine:v3.21 | openssh | 8.3_p1-r0 | ALPINE-CVE-2020-15778 |
| Alpine:v3.22 | openssh | 8.3_p1-r0 | ALPINE-CVE-2020-15778 |
| Alpine:v3.23 | openssh | 8.3_p1-r0 | ALPINE-CVE-2020-15778 |
| Alpine:v3.24 | openssh | 8.3_p1-r0 | ALPINE-CVE-2020-15778 |
| Debian:12 | openssh | no fix listed | DEBIAN-CVE-2020-15778 |
| Debian:13 | openssh | no fix listed | DEBIAN-CVE-2020-15778 |
| Debian:14 | openssh | no fix listed | DEBIAN-CVE-2020-15778 |
| Rocky Linux:8 | openssh | 0:8.0p1-24.el8 | RLSA-2024:3166 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.openssh.com/security.html
- https://github.com/cpandya2909/CVE-2020-15778/
- https://security.netapp.com/advisory/ntap-20200731-0007/
- https://news.ycombinator.com/item?id=25005567
- GLSA-202212-06 vendor-advisory
- https://access.redhat.com/errata/RHSA-2024:3166
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html