{"id":"CVE-2019-25018","aliases":["EUVD-2019-11471","GHSA-xxwg-wfjg-vgjp","MGASA-2021-0196","SUSE-SU-2021:0527-1"],"status":"published","title":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access...","description":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01565,"percentile":0.75513,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2021-02-02T17:23:31Z","modified":"2026-10-24T10:30:45Z","affected":[{"source":"osv","ecosystem":"Mageia:7","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-10.2.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-13.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"krb5-appl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":2}],"products":[{"vendor":"mit","product":"krb5-appl"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1131109","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25018"},{"url":"https://github.com/advisories/GHSA-xxwg-wfjg-vgjp"},{"url":"https://advisories.mageia.org/MGASA-2021-0196.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28460","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-February/008353.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210527-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131109","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25018","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-25018","description":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T17:23:31Z","modified":"2024-08-05T03:00:18.816Z","updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2019-11471","description":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T17:23:31Z","modified":"2024-08-05T03:00:18Z","updated_at":"2026-11-03T02:40:20.270172Z"}],"ghsa":[{"id":"GHSA-xxwg-wfjg-vgjp","title":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access...","description":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2022-05-24T17:40:45Z","modified":"2023-01-29T05:05:34Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:45:49.336023Z"}],"nvd":[{"id":"CVE-2019-25018","description":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T18:15:11.187Z","modified":"2026-06-17T02:31:29.46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:48.502374Z"}],"osv":[{"id":"CVE-2019-25018","description":"In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.","status":"published","published":"2021-02-02T18:15:11.187Z","modified":"2026-10-24T10:30:45.239678743Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"MGASA-2021-0196","title":"Updated krb5-appl packages fix security vulnerabilities","description":"An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp\nimplementation being derived from 1983 rcp, the server chooses which\nfiles/directories are sent to the client. However, the rcp client only\nperforms cursory validation of the object name returned (only directory\ntraversal attacks are prevented). A malicious rcp server (or\nMan-in-The-Middle attacker) can overwrite arbitrary files in the rcp client\ntarget directory. If recursive operation (-r) is performed, the server can\nmanipulate subdirectories as well (for example, to overwrite the\n.ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and\nCVE-2019-7283 (CVE-2019-25017).\n\nIn the rcp client in MIT krb5-appl through 1.0.3 malicious servers could\nbypass intended access restrictions via the filename of . or an empty\nfilename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying\nthe permissions of the target directory on the client side (CVE-2019-25018).\n","status":"published","published":"2021-04-23T22:53:14Z","modified":"2026-04-16T04:40:38.58421096Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"SUSE-SU-2021:0527-1","title":"Security update for krb5-appl","description":"This update for krb5-appl fixes the following issues:\n\n- CVE-2019-25017: Check the filenames sent by the server match those requested by the client (bsc#1131109).\n- CVE-2019-25018: Disallow empty incoming filename or ones that refer to the current directory (bsc#1131109).\n","status":"published","published":"2021-02-19T11:47:40Z","modified":"2026-02-04T03:13:06.927731Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}