What’s Vulnerable › Vulnerabilities

CVE-2019-7282

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-01-31 · updated 2026-06-17

Description

In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. This is similar to CVE-2018-20685.

Affected products

• Debian Linux: 9.0
• Fedoraproject Fedora: 34, 35, 36
• Netkit: through 0.17

References

• https://bugs.debian.org/920486
• https://lists.debian.org/debian-lts-announce/2021/11/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DU33YVEDGFDMAZPSRQTRVKSKG4FAX7QB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSEX3TKX2DBUKG4A7VJFDLSMZIBJQZ3G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA24VQJATZWYV42JG2PQUW7IHIZS7UKP/
• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
• https://bugs.debian.org/920486
• https://lists.debian.org/debian-lts-announce/2021/11/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DU33YVEDGFDMAZPSRQTRVKSKG4FAX7QB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSEX3TKX2DBUKG4A7VJFDLSMZIBJQZ3G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NA24VQJATZWYV42JG2PQUW7IHIZS7UKP/
• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Get alerted when CVE-2019-7282 or the next vulnerability affects your stack