CVE-2019-14889 — OS Command Injection in Libssh

CWE-78 — OS Command Injection11 documents9 sources
Severity
8.8HIGHNVD
EPSS
1.0%
top 22.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
LibsshOracle Mysql WorkbenchRED HAT Libssh+4 more
Timeline
PublishedDec 10
Latest updateMay 24

Description

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶NVDlibssh/libssh0.9.0 — 0.9.3+1
▶Debianlibssh/libssh< 0.9.3-1+3
▶CVEListV5red_hat/libsshAll libssh versions before 0.8.8, All libssh versions before 0.9.3+1
▶NVDopensuse/leap15.1

Also affects: Debian Linux 8.0, Fedora 30, 31, Ubuntu Linux 16.04, 18.04, 19.04, 19.10

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-mrxf-x73j-79wm: A flaw was found with the libssh API function ssh_scp_new() in versions before 0↗2022-05-24
▶
CVEList
CVE-2019-14889: A flaw was found with the libssh API function ssh_scp_new() in versions before 0↗2019-12-10
▶
OSV
CVE-2019-14889: A flaw was found with the libssh API function ssh_scp_new() in versions before 0↗2019-12-10
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle MySQL Risk Matrix: MySQL Workbench (libssh) — CVE-2019-14889↗2020-04-15
▶
Ubuntu
libssh vulnerability↗2019-12-10
▶
Red Hat
libssh: unsanitized location in scp could lead to unwanted command execution↗2019-12-05
▶
Debian
CVE-2019-14889: libssh - A flaw was found with the libssh API function ssh_scp_new() in versions before 0...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-14889 libssh: unsanitized location in scp could lead to unwanted command execution [fedora-all]↗2019-12-10
▶
Bugzilla
CVE-2019-14889 libssh: unsanitized location in scp could lead to unwanted command execution [epel-all]↗2019-12-10
▶
Bugzilla
CVE-2019-14889 libssh: unsanitized location in scp could lead to unwanted command execution↗2019-11-14
▶
CVE-2019-14889 — OS Command Injection in Libssh | cvebase