概要

scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of anomalous argument transfers because that could stand a great chance of breaking existing workflows. This is a temporary evasion solution that filters the SCP command parameters with special characters to reduce the risk of command injection. To make the changes take effect, add StrictScpCheck yes to the /etc/ssh/sshd_config configuration file and run the systemctl restart sshd command to restart the service.

CVSS v3 指标

安全公告

影响产品