CVSS: 7.1EPSS: 0%CPEs: 12EXPL: 0CVE-2021-28041
https://notcve.org/view.php?id=CVE-2021-28041
ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host. ssh-agent en OpenSSH versiones anteriores a 8.5, presenta una doble liberación que puede ser relevante en algunos escenarios menos comunes, como el acceso sin restricciones al socket del agente en un sistema operativo heredado o el reenvío de un agente a un host controlado por el atacante • https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQWGII3LQR4AOTPPFXGMTYE7UDEWIUKI https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TXST2CML2MWY3PNVUXX7FFJE3ATJMNVZ https://security.gentoo.org/glsa/202105-35 https://security.netapp.com/advisory/ntap-20210416-0002 https://www.openssh.com/security.html https://www.openssh.com/txt/release-8.5 https://www • CWE-415: Double Free •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 3CVE-2020-15778 – openssh: scp allows command injection when using backtick characters in the destination argument
https://notcve.org/view.php?id=CVE-2020-15778
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows." ** EN DISPUTA ** scp en OpenSSH versiones hasta 8.3p1 permite una inyección de comandos en la función toremote de scp.c, como lo demuestran los caracteres backtick en el argumento de destino. NOTA: según se informa, el proveedor ha declarado que omite intencionadamente la validación de las "transferencias de argumentos anómalos" porque eso podría "tener grandes posibilidades de romper los flujos de trabajo existentes" A flaw was found in the scp program shipped with the openssh-clients package. An attacker having the ability to scp files to a remote server, could execute arbitrary commands on the remote server by including the command as a part of the filename being copied on the server. This command is run with the permissions of user with which the files were copied on the remote server. • https://github.com/cpandya2909/CVE-2020-15778 https://github.com/Neko-chanQwQ/CVE-2020-15778-Exploit https://github.com/Evan-Zhangyf/CVE-2020-15778 https://access.redhat.com/errata/RHSA-2024:3166 https://news.ycombinator.com/item?id=25005567 https://security.gentoo.org/glsa/202212-06 https://security.netapp.com/advisory/ntap-20200731-0007 https://www.openssh.com/security.html https://access.redhat.com/security/cve/CVE-2020-15778 https://bugzilla.redhat.com/show_bug.cgi?id&# • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.9EPSS: 0%CPEs: 13EXPL: 0CVE-2020-14145 – openssh: Observable discrepancy leading to an information leak in the algorithm negotiation
https://notcve.org/view.php?id=CVE-2020-14145
The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected. El lado del cliente en OpenSSH versiones 5.7 hasta 8.4, presenta una Discrepancia Observable que conlleva a una filtración de información en la negociación del algoritmo. Esto permite a atacantes de tipo man-in-the-middle apuntar a unos intentos iniciales de conexión (donde ninguna clave de host para el servidor ha sido almacenada en caché por parte del cliente) NOTA: algunos informes afirman que las versiones 8.5 y 8.6 también están afectadas. • http://www.openwall.com/lists/oss-security/2020/12/02/1 https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d https://docs.ssh-mitm.at/CVE-2020-14145.html https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1 https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py https://security.gentoo.org/glsa/202105-35 https://security.netapp.com/advisory/ntap-20200709-0004 https://www. • CWE-203: Observable Discrepancy •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-12062
https://notcve.org/view.php?id=CVE-2020-12062
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances. ** EN DISPUTA** El cliente scp en OpenSSH versión 8.2 envía incorrectamente respuestas duplicadas al servidor tras un fallo en la llamada de sistema utimes, lo que permite a un usuario malicioso sin privilegios en el servidor remoto sobrescribir archivos arbitrarios en el directorio de descarga del cliente mediante la creación de un subdirectorio diseñado en cualquier lugar del servidor remoto. La víctima debe usar el comando scp -rp para descargar una jerarquía de archivos que contenga, en cualquier lugar de su interior, este subdirectorio creado. NOTA: el vendedor señala que "este ataque no puede lograr más de lo que un peer hostil ya se puede lograr dentro del protocolo scp" y "utimes no presenta un fallo bajo circunstancias normales". • https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1 https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894 https://www.openssh.com/txt/release-8.3 https://www.openwall.com/lists/oss-security/2020/05/27/1 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 2CVE-2019-16905
https://notcve.org/view.php?id=CVE-2019-16905
OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a crafted XMSS key. This leads to memory corruption and local code execution because of an error in the XMSS key parsing algorithm. NOTE: the XMSS implementation is considered experimental in all released OpenSSH versions, and there is no supported way to enable it when building portable OpenSSH. OpenSSH 7.7 a 7.9 y 8.x anterior de la versión 8.1, cuando se compila con un tipo de clave experimental, tiene un desbordamiento de entero de identificación previa si un cliente o servidor está configurado para usar una clave XMSS especialmente diseñada. Esto conduce a la corrupción de la memoria y la ejecución del código local debido a un error en el algoritmo de análisis de claves XMSS. • https://0day.life/exploits/0day-1009.html https://bugzilla.suse.com/show_bug.cgi?id=1153537 https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshkey-xmss.c.diff?r1=1.5&r2=1.6&f=h https://security.gentoo.org/glsa/201911-01 https://security.netapp.com/advisory/ntap-20191024-0003 https://ssd-disclosure.com/archives/4033&#x • CWE-190: Integer Overflow or Wraparound •