| Summary: | Will future versions of openssh fix CVE-2020-15778? | ||
|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | kircher <kircherlike> |
| Component: | scp | Assignee: | Assigned to nobody <unassigned-bugs> |
| Status: | CLOSED FIXED | ||
| Severity: | security | CC: | djm |
| Priority: | P5 | ||
| Version: | 8.3p1 | ||
| Hardware: | ARM64 | ||
| OS: | Linux | ||
|
Description
kircher
2020-08-08 14:22:17 AEST
this CVE stems from a misunderstanding of how scp works. It is an old program that *deliberately* invokes the remote shell for glob pattern expansion. We're not going to "fix" scp, but we might replace it entirely. There are significant backwards-compatibility concerns to work through however. Maybe we can prevent this by configuring the mandatory command. A simple example is： ForceCommand if [[ -z $SSH_ORIGINAL_COMMAND ]];then exec /bin/bash -il;elif [[ -z "$(echo $SSH_ORIGINAL_COMMAND | grep scp | grep '`')" ]];then exec /bin/bash -c "$SSH_ORIGINAL_COMMAND";else echo backquote not allow in scp;fi OpenSSH now uses sftp by default in the scp command OpenSSH 9.3 has been released. Close resolved bugs |