In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
{ "vanir_signatures": [ { "digest": { "line_hashes": [ "302129403808892202751107050716447255615", "81754403452350988572066121963610991510", "292440030647065191483533681366398077810", "151193644289348312604596337242161711444", "223618394384082972896881724008970952628" ], "threshold": 0.9 }, "signature_type": "Line", "id": "CVE-2018-20685-b442c2b5", "target": { "file": "scp.c" }, "source": "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2", "signature_version": "v1", "deprecated": false }, { "digest": { "function_hash": "284960368759419524838090916568148760402", "length": 6783.0 }, "signature_type": "Function", "id": "CVE-2018-20685-e7e06dcc", "target": { "file": "scp.c", "function": "sink" }, "source": "https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2", "signature_version": "v1", "deprecated": false } ] }