The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2017-15906.json"