What’s Vulnerable › Vulnerabilities

CVE-2018-20685

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-01-10 · updated 2026-06-17
• Weakness: CWE-863

Description

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.

Affected products

• Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
• Debian Linux: 8.0, 9.0
• Fujitsu M10-1 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M10-4 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M10-4S Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M12-1 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M12-2 Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• Fujitsu M12-2S Firmware: before xcp2361; before xcp3070 — fixed in xcp2361, xcp3070
• NetApp Cloud Backup: all versions
• NetApp Element Software: all versions
• NetApp Ontap Select Deploy: all versions
• NetApp Steelstore Cloud Integrated Storage: all versions
• NetApp Storage Automation Store: all versions
• OpenSSH: through 7.9
• Oracle Corporation Solaris Operating System: 10
• Red Hat Enterprise Linux: 7.0, 8.0
• RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6
• RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6
• RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6
• Siemens Scalance X204Rna Eec Firmware: before 3.2.7 — fixed in 3.2.7
• Siemens Scalance X204Rna Firmware: before 3.2.7 — fixed in 3.2.7
• Winscp: through 5.13

How to fix

Upgrade to a fixed version: Fujitsu M10-1 Firmware xcp2361, xcp3070; Fujitsu M10-4 Firmware xcp2361, xcp3070; Fujitsu M10-4S Firmware xcp2361, xcp3070; Fujitsu M12-1 Firmware xcp2361, xcp3070; Fujitsu M12-2 Firmware xcp2361, xcp3070; Fujitsu M12-2S Firmware xcp2361, xcp3070; Siemens Scalance X204Rna Eec Firmware 3.2.7; Siemens Scalance X204Rna Firmware 3.2.7. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/106531
• https://access.redhat.com/errata/RHSA-2019:3702
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h
• https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2
• https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html
• https://security.gentoo.org/glsa/201903-16
• https://security.gentoo.org/glsa/202007-53
• https://security.netapp.com/advisory/ntap-20190215-0001/
• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
• https://usn.ubuntu.com/3885-1/
• https://www.debian.org/security/2019/dsa-4387

Get alerted when CVE-2018-20685 or the next vulnerability affects your stack