CVE-2017-15906

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-26 · updated 2026-06-17
Weakness: CWE-732

Description

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

Affected products

Debian Linux: 8.0
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Cloud Backup: all versions
Clustered Data ONTAP: all versions
NetApp Cn1610 Firmware: all versions
NetApp Data Ontap Edge: all versions
NetApp Hci Management Node: all versions
NetApp Oncommand Unified Manager Core Package: all versions
NetApp Solidfire: all versions
NetApp Steelstore Cloud Integrated Storage: all versions
NetApp Storage Replication Adapter For Clustered Data Ontap: from 9.7; 9.6
NetApp Vasa Provider For Clustered Data Ontap: from 6.0 through 6.2; from 9.7
NetApp Virtual Storage Console: from 9.7; 9.6
OpenSSH: before 7.6 — fixed in 7.6
Oracle Corporation Sun ZFS Storage Appliance Kit (AK) Software: 8.8.6
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Eus: 7.6, 7.7
RedHat Enterprise Linux Server: 7.0
RedHat Enterprise Linux Server Aus: 7.6, 7.7
RedHat Enterprise Linux Server Tus: 7.6, 7.7
RedHat Enterprise Linux Workstation: 7.0

How to fix

Upgrade to a fixed version: OpenSSH 7.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-15906 or the next vulnerability affects your stack