{"id":"CVE-2017-15906","aliases":["ALPINE-CVE-2017-15906","BELL-CVE-2017-15906","DEBIAN-CVE-2017-15906","DLA-1500-1","EUVD-2017-7325","GHSA-543w-q592-87ph","MGASA-2017-0483","MGASA-2018-0006","RHSA-2018:0980","SUSE-SU-2017:3230-1","SUSE-SU-2018:2275-1","SUSE-SU-2018:2685-1","SUSE-SU-2018:2719-1","SUSE-SU-2018:3540-1","UBUNTU-CVE-2017-15906","USN-3538-1"],"status":"published","title":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write...","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03359,"percentile":0.88797,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2017-10-25T00:00:00Z","modified":"2026-10-24T14:09:09Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"openssh","fixed_in":["7.2_p1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"openssh","fixed_in":["7.4_p1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"openssh","fixed_in":["7.5_p1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"openssh","fixed_in":["7.5_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openssh","fixed_in":["7.5_p1-r8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openssh","fixed_in":["1:7.6p1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssh","fixed_in":["1:7.6p1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssh","fixed_in":["1:7.6p1-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"openssh","fixed_in":["7.5p1-2.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-cavs","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-cavs","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-cavs","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-cavs","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","fixed_in":["0:7.4p1-16.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-2.16.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"openssh","fixed_in":["1:6.6p1-2ubuntu2.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openssh","fixed_in":["1:7.2p2-4ubuntu2.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"openssh","fixed_in":["1:7.6p1-4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2_p1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4_p1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5_p1-r8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.7p1-5+deb8u6"}]}],"versions":["1:6.7p1-5","1:6.7p1-5+deb8u1","1:6.7p1-5+deb8u2","1:6.7p1-5+deb8u3","1:6.7p1-5+deb8u4","1:6.7p1-5+deb8u5"],"bundled":12},{"source":"osv","ecosystem":"Mageia:6","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5p1-2.1.mga6"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-5.10.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"openssh-server-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.4p1-16.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-2.16.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2p2-74.11.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-36.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.15.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.15.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.15.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-54.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"openssh-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6p1-19.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"openssh-askpass-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2p2-0.41.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.10"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.4"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.6p1-4"}]}],"versions":["1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.6p1-2ubuntu2.10"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2p2-4ubuntu2.4"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2"],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"cn1610_firmware"},{"vendor":"netapp","product":"data_ontap_edge"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"oncommand_unified_manager_core_package"},{"vendor":"netapp","product":"solidfire"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"netapp","product":"storage_replication_adapter_for_clustered_data_ontap"},{"vendor":"netapp","product":"vasa_provider_for_clustered_data_ontap"},{"vendor":"netapp","product":"virtual_storage_console"},{"vendor":"openbsd","product":"openssh"},{"vendor":"oracle","product":"sun_zfs_storage_appliance_kit"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://www.openssh.com/txt/release-7.6","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/101552","tags":["vdb-entry","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201801-05","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180423-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0980","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15906","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20180423-0004"},{"url":"https://github.com/advisories/GHSA-543w-q592-87ph"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-15906","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-15906","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15906","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0483.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22104","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VZIQDU7D6MLXFXZ4R3ZG2FCH6EDR3MBD/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0006.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406293","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456853","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1488083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1488982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1496467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1496808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506630","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0980.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-15906","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15906","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173230-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1006166","tags":["report"]},{"url":"https://bugzilla.suse.com/1048367","tags":["report"]},{"url":"https://bugzilla.suse.com/1065000","tags":["report"]},{"url":"https://bugzilla.suse.com/1068310","tags":["report"]},{"url":"https://bugzilla.suse.com/1069509","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15906","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182275-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016370","tags":["report"]},{"url":"https://bugzilla.suse.com/1017099","tags":["report"]},{"url":"https://bugzilla.suse.com/1023275","tags":["report"]},{"url":"https://bugzilla.suse.com/1053972","tags":["report"]},{"url":"https://bugzilla.suse.com/1076957","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10708","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182685-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092582","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182719-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183540-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1105010","tags":["report"]},{"url":"https://bugzilla.suse.com/1105180","tags":["report"]},{"url":"https://bugzilla.suse.com/1106163","tags":["report"]},{"url":"https://bugzilla.suse.com/1106726","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15473","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-15906","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3538-1","tags":["advisory"]},{"url":"https://xorl.wordpress.com/2017/11/13/openssh-sftp-server-remote-security-vulnerability/","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10009","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10011","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10012","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-15906","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-26T00:00:00Z","modified":"2026-05-28T17:56:04.112Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:33:14.556599Z"}],"euvd":[{"id":"EUVD-2017-7325","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-26T00:00:00Z","modified":"2026-05-28T17:56:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:21:02.186346Z"}],"ghsa":[{"id":"GHSA-543w-q592-87ph","title":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write...","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2022-05-13T01:18:21Z","modified":"2025-04-20T03:47:37Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T15:01:53.867735Z"}],"nvd":[{"id":"CVE-2017-15906","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-26T03:29:00.22Z","modified":"2026-06-17T01:08:27.43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"ALPINE-CVE-2017-15906","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-26T03:29:00.22Z","modified":"2026-06-15T18:18:06.770082139Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-15906","title":"CVE-2017-15906 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:23.337443Z","modified":"2026-01-26T09:48:20.473246Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-15906","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-26T03:29:00.22Z","modified":"2026-10-24T14:09:09.789871555Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-15906","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-26T03:29:00.22Z","modified":"2026-09-01T20:02:41.369199141Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"RHSA-2018:0980","title":"Red Hat Security Advisory: openssh security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:50:47Z","modified":"2026-06-26T12:21:03.848201733Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2017-15906","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.","status":"published","published":"2017-10-25T00:00:00Z","modified":"2026-05-29T18:00:11.299907266Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DLA-1500-1","title":"openssh - security update","status":"published","published":"2018-09-10T00:00:00Z","modified":"2026-03-09T01:01:44.380043Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2017-0483","title":"Updated openssh packages fix security vulnerability","description":"The process_open function in sftp-server.c in OpenSSH before 7.6 does\nnot properly prevent write operations in readonly mode, which allows\nattackers to create zero-length files (CVE-2017-15906).\n","status":"published","published":"2017-12-31T15:14:43Z","modified":"2026-04-16T06:24:46.083605595Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0006","title":"Updated openssh packages fix security vulnerability","description":"It was found that the boundary checks in the code implementing support for\npre-authentication compression could have been optimized out by certain\ncompilers. An attacker able to compromise the privilege-separated process\ncould possibly use this flaw for further attacks against the privileged\nmonitor process (CVE-2016-10012).\n\nThe process_open function in sftp-server.c in OpenSSH before 7.6 does not\nproperly prevent write operations in readonly mode, which allows attackers\nto create zero-length files (CVE-2017-15906).\n","status":"published","published":"2018-01-01T10:38:51Z","modified":"2026-04-16T06:25:46.063078725Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:3230-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server (bsc#1065000).\n\nBug fixes:\n\n- FIPS: Startup selfchecks (bsc#1068310).\n- FIPS: Silent complaints about unsupported key exchange methods (bsc#1006166).\n- Refine handling of sockets for X11 forwarding to remove reintroduced CVE-2008-1483 (bsc#1069509).\n- Test configuration before running daemon to prevent looping resulting in service shutdown (bsc#1048367)\n","status":"published","published":"2017-12-07T12:22:05Z","modified":"2026-02-04T04:16:16.805173Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2018:2275-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-10012: Fix pre-auth compression checks that could be optimized away (bsc#1016370).\n- CVE-2016-10708: Fix remote denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYSmessage (bsc#1076957).\n- CVE-2017-15906: Fix r/o sftp-server zero byte file creation (bsc#1065000).\n- CVE-2008-1483: Fix accidental re-introduction of CVE-2008-1483 (bsc#1069509).\n\nBug fixes:\n\n- bsc#1017099: Match conditions with uppercase hostnames fail (bsc#1017099)\n- bsc#1053972: supportedKeyExchanges diffie-hellman-group1-sha1 is duplicated (bsc#1053972)\n- bsc#1023275: Messages suppressed after upgrade from SLES 11 SP3 to SP4 (bsc#1023275)\n","status":"published","published":"2018-08-09T13:56:33Z","modified":"2026-02-04T03:32:42.030395Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:2685-1","title":"Security update for openssh","description":"This update for openssh provides the following fixes:\n\nSecurity issues fixed:\n\n- CVE-2017-15906: Stricter checking of operations in read-only mode in sftp server (bsc#1065000).\n- CVE-2016-10012: Remove pre-auth compression support from the server to prevent possible cryptographic attacks (bsc#1016370).\n- CVE-2008-1483: Refine handling of sockets for X11 forwarding to remove reintroduced CVE-2008-1483 (bsc#1069509).\n- CVE-2016-10708: Prevent DoS due to crashes caused by out-of-sequence NEWKEYS message (bsc#1076957).\n\nBug fixes:\n\n- bsc#1017099: Enable case-insensitive hostname matching.\n- bsc#1023275: Add a new switch for printing diagnostic messages in sftp client's batch mode.\n- bsc#1048367: systemd integration to work around various race conditions.\n- bsc#1053972: Remove duplicate KEX method.\n- bsc#1092582: Add missing piece of systemd integration.\n- Remove the limit on the amount of tasks sshd can run.\n","status":"published","published":"2018-09-11T08:50:47Z","modified":"2025-05-02T04:03:48.345767Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:2719-1","title":"Security update for openssh-openssl1","description":"This update for openssh-openssl1 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2016-10708: Prevent NULL pointer dereference via an out-of-sequence\n  NEWKEYS message allowed remote attackers to cause a denial of service\n  (bsc#1076957).\n- CVE-2017-15906: The process_open function did not properly prevent write\n  operations in readonly mode, which allowed attackers to create zero-length\n  files (bsc#1065000).\n- CVE-2016-10012: The shared memory manager (associated with pre-authentication\n  compression) did not ensure that a bounds check is enforced by all compilers,\n  which might have allowed local users to gain privileges by leveraging access to\n  a sandboxed privilege-separation process, related to the m_zback and m_zlib\n  data structures (bsc#1016370).\n- CVE-2008-1483: Prevent local users from hijacking forwarded X connections by\n  causing ssh to set DISPLAY to :10, even when another process is listening on\n  the associated port. This problem was reontroduced by another patch and was\n  previously fixed by another update (bsc#1069509).\n\nThese non-security issues were fixed:\n\n- Remove duplicate KEX method (bsc#1053972)\n- New switch for printing diagnostic messages in sftp client's batch mode (bsc#1023275)\n- Enable case-insensitive hostname matching (bsc#1017099)\n","status":"published","published":"2018-09-14T14:06:53Z","modified":"2026-02-04T04:34:01.294564Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3540-1","title":"Security update for openssh","description":"This update for openssh fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such a username enumeration (or 'oracle') as a vulnerability. (bsc#1106163)\n- CVE-2017-15906: The process_open function in sftp-server.c in OpenSSH did not properly prevent write operations in readonly mode, which allowed attackers to create zero-length files. (bsc#1065000, bsc#1106726)\n- CVE-2016-10708: sshd allowed remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c.  (bsc#1076957)\n- CVE-2018-15473: OpenSSH was prone to a user existance oracle vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c. (bsc#1105010)\n- CVE-2016-10012: Removed pre-auth compression support from the server to prevent possible cryptographic attacks.  (bsc#1016370)\n\nBugs fixed:\n\n- Fixed failing 'AuthorizedKeysCommand' within a 'Match User' block in sshd_config (bsc#1105180)\n","status":"published","published":"2018-10-29T05:47:11Z","modified":"2026-02-04T03:29:27.07426Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3538-1","title":"openssh vulnerabilities","description":"Jann Horn discovered that OpenSSH incorrectly loaded PKCS#11 modules from\nuntrusted directories. A remote attacker could possibly use this issue to\nexecute arbitrary PKCS#11 modules. This issue only affected Ubuntu 14.04\nLTS and Ubuntu 16.04 LTS. (CVE-2016-10009)\n\nJann Horn discovered that OpenSSH incorrectly handled permissions on\nUnix-domain sockets when privilege separation is disabled. A local attacker\ncould possibly use this issue to gain privileges. This issue only affected\nUbuntu 16.04 LTS. (CVE-2016-10010)\n\nJann Horn discovered that OpenSSH incorrectly handled certain buffer memory\noperations. A local attacker could possibly use this issue to obtain\nsensitive information. This issue only affected Ubuntu 14.04 LTS and Ubuntu\n16.04 LTS. (CVE-2016-10011)\n\nGuido Vranken discovered that OpenSSH incorrectly handled certain shared\nmemory manager operations. A local attacker could possibly use issue to\ngain privileges. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04\nLTS. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.\n(CVE-2016-10012)\n\nMichal Zalewski discovered that OpenSSH incorrectly prevented write\noperations in readonly mode. A remote attacker could possibly use this\nissue to create zero-length files, leading to a denial of service.\n(CVE-2017-15906)\n","status":"published","published":"2018-01-22T16:50:31Z","modified":"2026-06-01T07:15:24.993550592Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}