OS command injection in Red Hat libssh
Priority MEDIUM 44CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
Why it matters now
EPSS 0.03174 88th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | libssh | before 0.9.3; before 0.8.8 | 0.9.3, 0.8.8 | Patch available | CNA |
- libssh VendorRed Hat Affected before 0.9.3; before 0.8.8 Fixed in 0.9.3, 0.8.8 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:* | before 0.8.8; 0.9.0 to before 0.9.3 | Vulnerable | libssh |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | up to 8.0.19 | Vulnerable | Oracle |
- cpe:2.3:a:libssh:libssh:*:*:*:*:*:*:*:* Versions before 0.8.8; 0.9.0 to before 0.9.3 Vulnerable ·libssh
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.19 Vulnerable ·Oracle
Remediation
Red Hat 1 advisory
- RHSA-2020:4545 Released 2020-11-04 · Red Hat rating Moderatelibssh security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) libssh-devel-0.9.4-2.el8
- Red Hat Enterprise Linux BaseOS (v. 8) libssh-0.9.4-2.el8, libssh-config-0.9.4-2.el8
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:4545 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:4545 |
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Virtualization 4
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14889
- 2026-10-03 Alias added: GHSA-mrxf-x73j-79wm
References
Advisory 9
- USN-4219-1
- openSUSE-SU-2019:2689
- [debian-lts-announce] 20191217 [SECURITY] [DLA 2038-1] libssh security update
- FEDORA-2019-8b0ad69829
- FEDORA-2019-46b6bd2459
- openSUSE-SU-2020:0102
- GLSA-202003-27
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.libssh.org/security/advisories/CVE-2019-14889.txt
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-14889 · CVE Program
- CVE-2019-14889 · NVD
- FIRST EPSS
- GHSA-mrxf-x73j-79wm · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14889 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences