{"id":"CVE-2020-15778","aliases":["ALPINE-CVE-2020-15778","ALSA-2024:3166","BELL-CVE-2020-15778","DEBIAN-CVE-2020-15778","EUVD-2020-7762","GHSA-cvxm-8hgf-6m6m","OESA-2021-1377","RHSA-2024:3166","RLSA-2024:3166","UBUNTU-CVE-2020-15778"],"status":"disputed","title":"scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.13675,"percentile":0.96536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2020-07-24T00:00:00Z","modified":"2026-10-29T11:02:21Z","exploits":[{"source":"pocgithub","id":"cpandya2909/CVE-2020-15778","title":"cpandya2909/CVE-2020-15778","date":"2020-07-18","url":"https://github.com/cpandya2909/CVE-2020-15778"},{"source":"pocgithub","id":"Neko-chanQwQ/CVE-2020-15778-Exploit","title":"Neko-chanQwQ/CVE-2020-15778-Exploit","date":"2021-07-15","url":"https://github.com/Neko-chanQwQ/CVE-2020-15778-Exploit"},{"source":"pocgithub","id":"yifanzhg/CVE-2020-15778","title":"yifanzhg/CVE-2020-15778","date":"2023-09-27","url":"https://github.com/yifanzhg/CVE-2020-15778"},{"source":"pocgithub","id":"drackyjr/CVE-2020-15778-SCP-Command-Injection-Check","title":"drackyjr/CVE-2020-15778-SCP-Command-Injection-Check","date":"2025-07-28","url":"https://github.com/drackyjr/CVE-2020-15778-SCP-Command-Injection-Check"}],"fixes":[{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["8.3_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["8.3_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["8.3_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["8.3_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["8.3_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["8.3_p1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-askpass","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-cavs","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-clients","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-keycat","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-ldap","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"openssh-server","fixed_in":["8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pam_ssh_agent_auth","fixed_in":["0.10.3-7.24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.3-7.24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","fixed_in":["0:0.10.3-7.24.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","fixed_in":["0:0.10.3-7.24.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"openssh","fixed_in":["0:8.0p1-24.el8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3_p1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.3-7.24.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-1","1:10.0p1-2","1:10.0p1-3","1:10.0p1-4","1:10.0p1-5","1:10.0p1-5~bpo12+2","1:10.0p1-6","1:10.0p1-7","1:10.0p1-7~bpo12+1","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1","1:9.2p1-2","1:9.2p1-2+deb12u1","1:9.2p1-2+deb12u10","1:9.2p1-2+deb12u2","1:9.2p1-2+deb12u3","1:9.2p1-2+deb12u4","1:9.2p1-2+deb12u5","1:9.2p1-2+deb12u6","1:9.2p1-2+deb12u7","1:9.2p1-2+deb12u8","1:9.2p1-2+deb12u9","1:9.3p1-1","1:9.3p1-1+loong64","1:9.3p2-1","1:9.4p1-1","1:9.5p1-1","1:9.5p1-2","1:9.6p1-1","1:9.6p1-2","1:9.6p1-3","1:9.6p1-4","1:9.6p1-5","1:9.7p1-1","1:9.7p1-2","1:9.7p1-3","1:9.7p1-3+hurd.1","1:9.7p1-4","1:9.7p1-5","1:9.7p1-6","1:9.7p1-7","1:9.8p1-1","1:9.8p1-2","1:9.8p1-3","1:9.8p1-4","1:9.8p1-7","1:9.8p1-8","1:9.9p1-1","1:9.9p1-2","1:9.9p1-3","1:9.9p1-3+hurd.1","1:9.9p2-1","1:9.9p2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-7+deb13u1","1:10.0p1-7+deb13u2","1:10.0p1-7+deb13u3","1:10.0p1-7+deb13u4","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:10.0p1-7","1:10.0p1-8","1:10.1p1-1","1:10.1p1-2","1:10.2p1-1","1:10.2p1-2","1:10.2p1-2~bpo13+1","1:10.2p1-3","1:10.2p1-4","1:10.2p1-5","1:10.2p1-6","1:10.2p1-6~bpo13+1","1:10.3p1-1","1:10.3p1-1~bpo13+1","1:10.3p1-2","1:10.3p1-3","1:10.3p1-4","1:10.3p1-5","1:10.3p1-7","1:10.3p1-8","1:10.3p1-9","1:10.4p1-1","1:10.4p1-2","1:10.4p1-3","1:10.4p1-4","1:10.4p1-5","1:10.5p1-1","1:10.6p1-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2p1-14.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2p1-14.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-askpass-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-cavs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-clients-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-keycat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"openssh-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.24.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"pam_ssh_agent_auth-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.10.3-7.24.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.0p1-24.el8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.2p2-6","1:6.2p2-6ubuntu1","1:6.4p1-1","1:6.4p1-2","1:6.5p1-1","1:6.5p1-2","1:6.5p1-3","1:6.5p1-4","1:6.5p1-6","1:6.6p1-1","1:6.6p1-2","1:6.6p1-2ubuntu1","1:6.6p1-2ubuntu2","1:6.6p1-2ubuntu2.2","1:6.6p1-2ubuntu2.3","1:6.6p1-2ubuntu2.4","1:6.6p1-2ubuntu2.6","1:6.6p1-2ubuntu2.7","1:6.6p1-2ubuntu2.8","1:6.6p1-2ubuntu2.10","1:6.6p1-2ubuntu2.11","1:6.6p1-2ubuntu2.12","1:6.6p1-2ubuntu2.13","1:6.6p1-2ubuntu2.13+esm1","1:6.6p1-2ubuntu2.13+esm2","1:6.6p1-2ubuntu2.13+esm3","1:6.6p1-2ubuntu2.13+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:6.9p1-2","1:6.9p1-3","1:7.1p1-1","1:7.1p1-3","1:7.1p1-4","1:7.1p1-6","1:7.1p2-1","1:7.1p2-2","1:7.2p1-1","1:7.2p2-1","1:7.2p2-2","1:7.2p2-3","1:7.2p2-4","1:7.2p2-4ubuntu1","1:7.2p2-4ubuntu2.1","1:7.2p2-4ubuntu2.2","1:7.2p2-4ubuntu2.4","1:7.2p2-4ubuntu2.5","1:7.2p2-4ubuntu2.6","1:7.2p2-4ubuntu2.7","1:7.2p2-4ubuntu2.8","1:7.2p2-4ubuntu2.10","1:7.2p2-4ubuntu2.10+esm1","1:7.2p2-4ubuntu2.10+esm2","1:7.2p2-4ubuntu2.10+esm3","1:7.2p2-4ubuntu2.10+esm4","1:7.2p2-4ubuntu2.10+esm5","1:7.2p2-4ubuntu2.10+esm6","1:7.2p2-4ubuntu2.10+esm7","1:7.2p2-4ubuntu2.10+esm8","1:7.2p2-4ubuntu2.10+esm9","1:7.2p2-4ubuntu2.10+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-10","1:7.6p1-4","1:7.6p1-4ubuntu0.1","1:7.6p1-4ubuntu0.2","1:7.6p1-4ubuntu0.3","1:7.6p1-4ubuntu0.5","1:7.6p1-4ubuntu0.6","1:7.6p1-4ubuntu0.7","1:7.6p1-4ubuntu0.7+esm1","1:7.6p1-4ubuntu0.7+esm2","1:7.6p1-4ubuntu0.7+esm3","1:7.6p1-4ubuntu0.7+esm4","1:7.6p1-4ubuntu0.7+esm5","1:7.6p1-4ubuntu0.7+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-8","1:7.5p1-9","1:7.5p1-9build1","1:7.5p1-10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0p1-6build1","1:8.1p1-1","1:8.1p1-5","1:8.2p1-4","1:8.2p1-4ubuntu0.1","1:8.2p1-4ubuntu0.2","1:8.2p1-4ubuntu0.3","1:8.2p1-4ubuntu0.4","1:8.2p1-4ubuntu0.5","1:8.2p1-4ubuntu0.7","1:8.2p1-4ubuntu0.8","1:8.2p1-4ubuntu0.9","1:8.2p1-4ubuntu0.10","1:8.2p1-4ubuntu0.11","1:8.2p1-4ubuntu0.12","1:8.2p1-4ubuntu0.13","1:8.2p1-4ubuntu0.13+esm1","1:8.2p1-4ubuntu0.13+esm2","1:8.2p1-4ubuntu0.13+esm3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssh-ssh1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:7.5p1-11build1"]}],"products":[{"vendor":"broadcom","product":"fabric_operating_system"},{"vendor":"netapp","product":"a700s_firmware"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"hci_compute_node"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"hci_storage_node"},{"vendor":"netapp","product":"solidfire"},{"vendor":"netapp","product":"steelstore_cloud_integrated_storage"},{"vendor":"openbsd","product":"openssh"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://www.openssh.com/security.html","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/cpandya2909/CVE-2020-15778/","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://security.netapp.com/advisory/ntap-20200731-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://news.ycombinator.com/item?id=25005567","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202212-06","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3166","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15778","tags":["advisory"]},{"url":"https://github.com/cpandya2909/CVE-2020-15778","tags":["article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20200731-0007"},{"url":"https://github.com/advisories/GHSA-cvxm-8hgf-6m6m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-15778","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15778","tags":["report"]},{"url":"https://bugzilla.redhat.com/1860487","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3166.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-15778","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15778","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41617","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1860487","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-1684","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-5217","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-5221","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-5279","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-5321","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3166.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15778","tags":["advisory","report"]},{"url":"https://access.redhat.com/articles/5284081","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3166","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15778","tags":["report"]},{"url":"https://lwn.net/Articles/835962/","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"disputed","published":"2020-07-24T00:00:00Z","modified":"2026-10-14T09:34:59.182Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7762","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"published","published":"2020-07-24T00:00:00Z","modified":"2026-10-14T09:34:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:16.85534Z"}],"ghsa":[{"id":"GHSA-cvxm-8hgf-6m6m","title":"scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated...","description":"scp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"published","published":"2022-05-24T17:24:18Z","modified":"2026-10-14T12:31:15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:13:24.188405Z"}],"nvd":[{"id":"CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"disputed","published":"2020-07-24T14:15:12.45Z","modified":"2026-10-14T10:17:30.51Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:10.086163Z"}],"osv":[{"id":"ALPINE-CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"published","published":"2020-07-24T14:15:12.45Z","modified":"2026-10-26T11:17:55.135664775Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-15778","title":"CVE-2020-15778 does not affect BellSoft software","status":"withdrawn","published":"2020-07-24T14:15:00Z","modified":"2026-01-26T09:47:10.781026Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"published","published":"2020-07-24T14:15:12.45Z","modified":"2026-10-24T10:30:19.019888502Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"published","published":"2020-07-24T14:15:12.45Z","modified":"2026-10-26T12:02:27.037323841Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"OESA-2021-1377","title":"openssh security update","description":"OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.\r\n\r\nSecurity Fix(es):\r\n\r\nsshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.(CVE-2021-41617)\n\nscp in OpenSSH through 8.3p1 allows command injection in scp.c remote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of anomalous argument transfers because that could stand a great chance of breaking existing workflows.(CVE-2020-15778)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:04.78527863Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2024:3166","title":"Red Hat Security Advisory: openssh security update","status":"published","published":"2024-09-16T15:42:26Z","modified":"2026-06-26T12:22:22.405645852Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:3166","title":"Moderate: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: scp allows command injection when using backtick characters in the destination argument (CVE-2020-15778)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:11:34.309952Z","modified":"2025-05-07T19:38:04.685697Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2020-15778","description":"scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \"anomalous argument transfers\" because that could \"stand a great chance of breaking existing workflows.\"","status":"published","published":"2020-07-24T14:15:00Z","modified":"2026-09-22T22:51:43.879806017Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"ALSA-2024:3166","title":"Moderate: openssh security update","description":"OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.\n\nSecurity Fix(es):\n\n* openssh: scp allows command injection when using backtick characters in the destination argument (CVE-2020-15778)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:21.009487565Z","updated_at":"2026-11-02T15:27:52.553233Z"}]}}