CVE-2017-15906
- Source
- https://cve.org/CVERecord?id=CVE-2017-15906
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-15906.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-15906
- Downstream
- Related
- Published
- 2017-10-26T03:29:00.220Z
- Modified
- 2026-06-18T04:03:47.053645740Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
- Database specific
{ "unresolved_ranges": [ { "vendor_product": "netapp:storage_replication_adapter_for_clustered_data_ontap", "extracted_events": [ { "introduced": "9.7" } ], "cpes": [ "cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*" ], "source": "CPE_RANGE" }, { "vendor_product": "netapp:vasa_provider_for_clustered_data_ontap", "extracted_events": [ { "introduced": "6.0" }, { "last_affected": "6.2" }, { "introduced": "9.7" } ], "cpes": [ "cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*" ], "source": "CPE_RANGE" }, { "vendor_product": "netapp:virtual_storage_console", "extracted_events": [ { "introduced": "9.7" } ], "cpes": [ "cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:*" ], "source": "CPE_RANGE" }, { "vendor_product": "debian:debian_linux", "extracted_events": [ { "last_affected": "8.0" } ], "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "netapp:storage_replication_adapter_for_clustered_data_ontap", "extracted_events": [ { "last_affected": "9.6" } ], "cpes": [ "cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:9.6:*:*:*:*:vmware_vsphere:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "netapp:virtual_storage_console", "extracted_events": [ { "last_affected": "9.6" } ], "cpes": [ "cpe:2.3:a:netapp:virtual_storage_console:9.6:*:*:*:*:vmware_vsphere:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "oracle:sun_zfs_storage_appliance_kit", "extracted_events": [ { "last_affected": "8.8.6" } ], "cpes": [ "cpe:2.3:a:oracle:sun_zfs_storage_appliance_kit:8.8.6:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_desktop", "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_eus", "extracted_events": [ { "last_affected": "7.6" }, { "last_affected": "7.7" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_server", "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_server_aus", "extracted_events": [ { "last_affected": "7.6" }, { "last_affected": "7.7" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_server_tus", "extracted_events": [ { "last_affected": "7.6" }, { "last_affected": "7.7" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*" ], "source": "CPE_STRING" }, { "vendor_product": "redhat:enterprise_linux_workstation", "extracted_events": [ { "last_affected": "7.0" } ], "cpes": [ "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" ], "source": "CPE_STRING" } ] }- References
-
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- http://www.securityfocus.com/bid/101552
- https://access.redhat.com/errata/RHSA-2018:0980
- https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19
- https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
- https://security.gentoo.org/glsa/201801-05
- https://security.netapp.com/advisory/ntap-20180423-0004/
- https://www.openssh.com/txt/release-7.6
- https://www.oracle.com/security-alerts/cpujan2020.html
Affected packages
Git / github.com/openbsd/src
Git / github.com/openssh/openssh-portable
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssh/openssh-portable
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "7.6" } ], "cpe": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*", "source": "CPE_RANGE" }
Affected versions
Other
ABOUT_TO_ADD_INET_ATON
AFTER_FREEBSD_PAM_MERGE
AFTER_KRB5_GSSAPI_MERGE
BEFORE_FREEBSD_PAM_MERGE
BEFORE_KRB5_GSSAPI_MERGE
POST_KRB4_REMOVAL
PRE-REORDER
PRE_CYGWIN_MERGE
PRE_DAN_PATCH_MERGE
PRE_FIXPATHS_INTEGRATION
PRE_HPUX_INTEGRATION
PRE_IPV6
PRE_KRB4_REMOVAL
PRE_NEW_LOGIN_CODE
PRE_SW_KRBV
V_1_2PRE17
V_1_2_1_PRE18
V_1_2_1_PRE19
V_1_2_1_PRE20
V_1_2_1_PRE21
V_1_2_1_PRE22
V_1_2_1_PRE23
V_1_2_1_PRE24
V_1_2_1_PRE25
V_1_2_1_PRE26
V_1_2_1_PRE27
V_1_2_2
V_1_2_2_P1
V_1_2_2_PRE28
V_1_2_2_PRE29
V_1_2_3
V_1_2_3_PRE1
V_1_2_3_PRE2
V_1_2_3_PRE3
V_1_2_3_PRE4
V_1_2_3_PRE5
V_1_2_3_TEST1
V_1_2_3_TEST2
V_1_2_3_TEST3
V_1_2_PRE10
V_1_2_PRE11
V_1_2_PRE12
V_1_2_PRE13
V_1_2_PRE14
V_1_2_PRE15
V_1_2_PRE16
V_1_2_PRE4
V_1_2_PRE5
V_1_2_PRE6
V_1_2_PRE7
V_1_2_PRE8
V_1_2_PRE9
V_2_0_0_BETA1
V_2_0_0_BETA2
V_2_0_0_TEST1
V_2_1_0
V_2_1_0_P1
V_2_1_0_P2
V_2_1_0_P3
V_2_1_1_P1
V_2_1_1_P2
V_2_1_1_P3
V_2_1_1_P4
V_2_2_0_P1
V_2_3_0_P1
V_2_5_0_P1
V_2_5_1_P1
V_2_5_1_P2
V_2_5_2_P1
V_3_0_1_P1
V_3_0_P1
V_3_1_P1
V_3_2_2_P1
V_3_4_P1
V_3_6_1_P1
V_3_8_P1
V_3_9_P1
V_4_2_P1
V_5_0_P1
V_5_1_P1
V_5_2_P1
V_5_5_P1
V_5_7_P1
V_6_0_P1
V_6_1_P1
V_6_2_P1
V_6_5_P1
V_6_6_P1
V_6_8_P1
V_6_9_P1
V_7_0_P1
V_7_1_P1
V_7_2_P1
V_7_3_P1
V_7_4_P1
V_7_5_P1