Bug 675520

Summary:	<net-misc/openssh-7.9_p1-r2: improper check in scp.c:sink() allows malicious servers to bypass access restrictions in scp client (CVE-2018-20685)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	base-system, luke, robbat2
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	A3 [glsa+ cve]
Package list:	net-misc/openssh-7.9_p1-r2	Runtime testing required:	---
Bug Depends on:	675522
Bug Blocks:	728412

Description GLSAMaker/CVETool Bot gentoo-dev

2019-01-15 17:48:45 UTC

CVE-2018-20685 (https://nvd.nist.gov/vuln/detail/CVE-2018-20685):
  In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass
  intended access restrictions via the filename of . or an empty filename.

Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev

2019-01-15 18:00:39 UTC

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=45084b9a615f719976434938be717dfde3075133

Comment 2 Yury German Gentoo Infrastructure

2019-03-10 22:10:18 UTC

Since R2 is gone from the tree and R4 is going through stabilization under 675522, making this bug dependent.

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2019-03-20 13:37:04 UTC

This issue was resolved and addressed in
 GLSA 201903-16 at https://security.gentoo.org/glsa/201903-16
by GLSA coordinator Aaron Bauman (b-man).