{"id":"CVE-2019-25017","aliases":["EUVD-2019-11470","GHSA-hj6m-8794-335m","MGASA-2021-0196","SUSE-SU-2021:0527-1"],"status":"published","title":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation...","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01385,"percentile":0.72426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2021-02-02T17:23:58Z","modified":"2026-10-24T10:30:33Z","affected":[{"source":"osv","ecosystem":"Mageia:7","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-10.2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-13.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2}],"products":[{"vendor":"mit","product":"krb5-appl"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1131109","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25017"},{"url":"https://github.com/advisories/GHSA-hj6m-8794-335m"},{"url":"https://advisories.mageia.org/MGASA-2021-0196.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28460","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-February/008353.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210527-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131109","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25018","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-25017","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T17:23:58Z","modified":"2024-08-05T03:00:18.924Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-11470","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T17:23:58Z","modified":"2024-08-05T03:00:18Z","updated_at":"2026-11-03T02:40:20.270172Z"}],"ghsa":[{"id":"GHSA-hj6m-8794-335m","title":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation...","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2022-05-24T22:01:27Z","modified":"2023-01-30T05:04:42Z","updated_at":"2026-11-02T14:47:06.389944Z"}],"nvd":[{"id":"CVE-2019-25017","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T18:15:10.937Z","modified":"2026-06-17T02:31:29.35Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-25017","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T18:15:10.937Z","modified":"2026-10-24T10:30:33.404526757Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"MGASA-2021-0196","title":"Updated krb5-appl packages fix security vulnerabilities","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp\nimplementation being derived from 1983 rcp, the server chooses which\nfiles/directories are sent to the client. However, the rcp client only\nperforms cursory validation of the object name returned (only directory\ntraversal attacks are prevented). A malicious rcp server (or\nMan-in-The-Middle attacker) can overwrite arbitrary files in the rcp client\ntarget directory. If recursive operation (-r) is performed, the server can\nmanipulate subdirectories as well (for example, to overwrite the\n.ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and\nCVE-2019-7283 (CVE-2019-25017).\n\nIn the rcp client in MIT krb5-appl through 1.0.3 malicious servers could\nbypass intended access restrictions via the filename of . or an empty\nfilename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying\nthe permissions of the target directory on the client side (CVE-2019-25018).\n","status":"published","published":"2021-04-23T22:53:14Z","modified":"2026-04-16T04:40:38.58421096Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"SUSE-SU-2021:0527-1","title":"Security update for krb5-appl","description":"This update for krb5-appl fixes the following issues:\n\n- CVE-2019-25017: Check the filenames sent by the server match those requested by the client (bsc#1131109).\n- CVE-2019-25018: Disallow empty incoming filename or ones that refer to the current directory (bsc#1131109).\n","status":"published","published":"2021-02-19T11:47:40Z","modified":"2026-02-04T03:13:06.927731Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}