CVE-2026-35385
גבוהה 8.1
תיאור (מקור, אנגלית)
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
מדדים
- CVSS 3.1
-
8.1 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 1% (אחוזון 000) נכון ל-27/7/2026
- CWE
- CWE-281
מוצרים מושפעים
openbsd: openssh
קישורים
- https://marc.info/?l=openssh-unix-dev&m=177513443901484&w=2 Third Party Advisory
- https://www.openssh.org/releasenotes.html#10.3p1 Release Notes
- https://www.openwall.com/lists/oss-security/2026/04/02/3 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2026:12389
- https://access.redhat.com/errata/RHSA-2026:13380
- https://access.redhat.com/errata/RHSA-2026:13381
- https://access.redhat.com/errata/RHSA-2026:13383
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:16059
- https://access.redhat.com/errata/RHSA-2026:19069