Red Hat Security AdvisoryRHSA-2018:0980
openssh security, bug fix, and enhancement update
Released 2018-04-10 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssh-7.4p1-16.el7, openssh-askpass-7.4p1-16.el7, openssh-clients-7.4p1-16.el7 +2
- Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs-7.4p1-16.el7, openssh-ldap-7.4p1-16.el7, openssh-server-sysvinit-7.4p1-16.el7 +1
- Red Hat Enterprise Linux ComputeNode (v. 7) openssh-7.4p1-16.el7, openssh-clients-7.4p1-16.el7, openssh-keycat-7.4p1-16.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-askpass-7.4p1-16.el7, openssh-cavs-7.4p1-16.el7, openssh-ldap-7.4p1-16.el7 +2
- Red Hat Enterprise Linux Server (v. 7) openssh-7.4p1-16.el7, openssh-askpass-7.4p1-16.el7, openssh-clients-7.4p1-16.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs-7.4p1-16.el7, openssh-ldap-7.4p1-16.el7, openssh-server-sysvinit-7.4p1-16.el7 +2
- Red Hat Enterprise Linux Workstation (v. 7) openssh-7.4p1-16.el7, openssh-askpass-7.4p1-16.el7, openssh-clients-7.4p1-16.el7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs-7.4p1-16.el7, openssh-ldap-7.4p1-16.el7, openssh-server-sysvinit-7.4p1-16.el7 +1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssh-7.4p1-16.el7, openssh-askpass-7.4p1-16.el7, openssh-clients-7.4p1-16.el7 +2
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssh-cavs-7.4p1-16.el7, openssh-ldap-7.4p1-16.el7, openssh-server-sysvinit-7.4p1-16.el7 +1
Fixes 1 record
Priority LOW 36
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03359 · Published 2017-10-26 · Fixed CWE-732
