CVE catalog
CVE-2020-12062
openssh: CVE-2020-12062
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.23% · Oct 22, 2026
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | openssh | sid | 1:10.6p1-1 | fixed |
| Debian | openssh | forky | 1:10.6p1-1 | fixed |
| Debian | openssh | trixie | 1:10.0p1-7+deb13u4 | fixed |
| Debian | openssh | trixie-security | 1:10.0p1-7+deb13u2 | fixed |
| Debian | openssh | bookworm | 1:9.2p1-2+deb12u10 | fixed |
| Debian | openssh | bookworm-security | 1:9.2p1-2+deb12u9 | fixed |
| Cpe | openssh | Not reported | Not reported | unknown |
| Ubuntu | openssh | pro | 1:8.0p1-6build1 | vulnerable |
| Ubuntu | openssh | pro | 1:8.1p1-1 | vulnerable |
| Ubuntu | openssh | pro | 1:8.1p1-5 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.1 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.2 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.3 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.4 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.5 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.7 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.8 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.9 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.10 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.11 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.12 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.13 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.13+esm1 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.13+esm2 | vulnerable |
| Ubuntu | openssh | pro | 1:8.2p1-4ubuntu0.13+esm3 | vulnerable |
| Ubuntu | openssh-ssh1 | 18.04 | 1:7.5p1-8 | vulnerable |
| Ubuntu | openssh-ssh1 | 18.04 | 1:7.5p1-9 | vulnerable |
| Ubuntu | openssh-ssh1 | 18.04 | 1:7.5p1-9build1 | vulnerable |
| Ubuntu | openssh-ssh1 | 18.04 | 1:7.5p1-10 | vulnerable |
| Ubuntu | openssh-ssh1 | 20.04 | 1:7.5p1-11build1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | openssh | source | sid | 1:8.3p1-1 | unimportant | Not reported | Not reported |
| Debian | openssh | source | forky | 1:8.3p1-1 | unimportant | Not reported | Not reported |
| Debian | openssh | source | trixie | 1:8.3p1-1 | unimportant | Not reported | Not reported |
| Debian | openssh | source | bookworm | 1:8.3p1-1 | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [openssh-client]Fixed
Source package: [openssh]
Details (8)
1:9.2p1-2+deb12u10· amd64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u10· arm64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· amd64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· arm64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· amd64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· arm64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [openssh-client-gssapi]Fixed
Source package: [openssh]
Details (2)
1:10.0p1-7~bpo12+1· all · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· all · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [openssh-server]Fixed
Source package: [openssh]
Details (8)
1:9.2p1-2+deb12u10· amd64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u10· arm64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· amd64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· arm64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· amd64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· arm64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [openssh-server-gssapi]Fixed
Source package: [openssh]
Details (2)
1:10.0p1-7~bpo12+1· all · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· all · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [openssh-sftp-server]Fixed
Source package: [openssh]
Details (8)
1:9.2p1-2+deb12u10· amd64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u10· arm64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· amd64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· arm64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· amd64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· arm64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [openssh-tests]Fixed
Source package: [openssh]
Details (8)
1:9.2p1-2+deb12u10· amd64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u10· arm64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· amd64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· arm64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· amd64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· arm64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [ssh]Fixed
Source package: [openssh]
Details (8)
1:9.2p1-2+deb12u10· all · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u10· all · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· all · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· all · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· all · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· all · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· all · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· all · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
- [ssh-askpass-gnome]Fixed
Source package: [openssh]
Details (8)
1:9.2p1-2+deb12u10· amd64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u10· arm64 · bookwormFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· amd64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:10.0p1-7~bpo12+1· arm64 · bookworm-backportsFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· amd64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u9· arm64 · bookworm-securityFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· amd64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
1:9.2p1-2+deb12u7· arm64 · bookworm-updatesFixed · Fixed:
1:8.3p1-1dsa · openssh · debian · bookworm
Observed:
References
- [https://cert-portal.siemens.com/productcert/csaf/ssa-398330.json]
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2020-12062]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2020-12062]
- [https://security-tracker.debian.org/tracker/CVE-2020-12062]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1082.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]