CVE catalog

CVE-2020-15778

openssh: CVE-2020-15778

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Jul 24, 2020, 2:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 13.68% · Oct 22, 2026

A flaw was found in the scp program shipped with the openssh-clients package. An attacker having the ability to scp files to a remote server, could execute arbitrary commands on the remote server by including the command as a part of the filename being copied on the server. This command is run with the permissions of user with which the files were copied on the remote server. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability depending on the default system umask and selinux policy/enforcement. openssh: scp allows command injection when using backtick characters in the destination argument This security flaw lies in the way scp command parses its command line arguments. The SSH protocol or any other applications shipped as a part of openssh-clients packages are not vulnerable. In order to exploit this flaw, the attacker needs to social engineer or manipulate a system administrator (who has root access on the remote server) to run scp with a malicious command line parameter. Administrators can uninstall openssh-clients for additional protection against accidental usage of this binary. Removing the openssh-clients package will make binaries like scp and ssh etc unavailable on that system. Also administrators can change the execute permissions on the scp binary. However this mitigation will be in place until the openssh-clients package is updated. The loss of confidentiality, integrity and availability would depend on the system umask and selinux policies. For example, if the system umask is 000, one user CAN get access to another user's files and even execute them. However default umask for pretty much any modern unix system is 033, which gives a default permisson of 744. This does not cause any confidentiality problems that already does not exist outside of the scope of this bug. Also since the default permissions based on the umask would guard write and execute, there is no way to cause any loss of Integrity or Availability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openssh	sid	`1:10.6p1-1`	vulnerable
Debian	openssh	forky	`1:10.6p1-1`	vulnerable
Debian	openssh	trixie	`1:10.0p1-7+deb13u4`	vulnerable
Debian	openssh	trixie-security	`1:10.0p1-7+deb13u2`	vulnerable
Debian	openssh	bookworm	`1:9.2p1-2+deb12u10`	vulnerable
Debian	openssh	bookworm-security	`1:9.2p1-2+deb12u9`	vulnerable
Cpe	openssh	Not reported	Not reported	unknown
Cpe	a700s_firmware	Not reported	Not reported	unknown
Cpe	active_iq_unified_manager	Not reported	Not reported	unknown
Cpe	hci_management_node	Not reported	Not reported	unknown
Cpe	solidfire	Not reported	Not reported	unknown
Cpe	steelstore_cloud_integrated_storage	Not reported	Not reported	unknown
Cpe	hci_compute_node	Not reported	Not reported	unknown
Cpe	hci_storage_node	Not reported	Not reported	unknown
Cpe	fabric_operating_system	Not reported	Not reported	unknown
Ubuntu	openssh	pro	`1:8.0p1-6build1`	vulnerable
Ubuntu	openssh	pro	`1:8.1p1-1`	vulnerable
Ubuntu	openssh	pro	`1:8.1p1-5`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.1`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.2`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.3`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.4`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.5`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.7`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.8`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.9`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.10`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.11`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.12`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.13`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.13+esm1`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.13+esm2`	vulnerable
Ubuntu	openssh	pro	`1:8.2p1-4ubuntu0.13+esm3`	vulnerable
Ubuntu	openssh-ssh1	18.04	`1:7.5p1-8`	vulnerable
Ubuntu	openssh-ssh1	18.04	`1:7.5p1-9`	vulnerable
Ubuntu	openssh-ssh1	18.04	`1:7.5p1-9build1`	vulnerable
Ubuntu	openssh-ssh1	18.04	`1:7.5p1-10`	vulnerable
Ubuntu	openssh-ssh1	20.04	`1:7.5p1-11build1`	vulnerable
Alpine	openssh	3.19	`8.3_p1-r0`	fixed
Alpine	openssh	3.20	`8.3_p1-r0`	fixed
Alpine	openssh	3.21	`8.3_p1-r0`	fixed
Alpine	openssh	3.22	`8.3_p1-r0`	fixed
Alpine	openssh	3.23	`8.3_p1-r0`	fixed
Alpine	openssh	3.24	`8.3_p1-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openssh	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	openssh	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	openssh	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	openssh	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported
Alpine	openssh	apk	3.19	`8.3_p1-r0`	Not reported	ALPINE-CVE-2020-15778	Not reported
Alpine	openssh	apk	3.20	`8.3_p1-r0`	Not reported	ALPINE-CVE-2020-15778	Not reported
Alpine	openssh	apk	3.21	`8.3_p1-r0`	Not reported	ALPINE-CVE-2020-15778	Not reported
Alpine	openssh	apk	3.22	`8.3_p1-r0`	Not reported	ALPINE-CVE-2020-15778	Not reported
Alpine	openssh	apk	3.23	`8.3_p1-r0`	Not reported	ALPINE-CVE-2020-15778	Not reported
Alpine	openssh	apk	3.24	`8.3_p1-r0`	Not reported	ALPINE-CVE-2020-15778	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[openssh-client]Affected
Source package: [openssh]
Details (8)
- 1:9.2p1-2+deb12u10 · amd64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u10 · arm64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · amd64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · arm64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · amd64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · arm64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
[openssh-client-gssapi]Affected
Source package: [openssh]
Details (2)
- 1:10.0p1-7~bpo12+1 · all · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · all · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
[openssh-server]Affected
Source package: [openssh]
Details (8)
- 1:9.2p1-2+deb12u10 · amd64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u10 · arm64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · amd64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · arm64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · amd64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · arm64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
[openssh-server-gssapi]Affected
Source package: [openssh]
Details (2)
- 1:10.0p1-7~bpo12+1 · all · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · all · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
[openssh-sftp-server]Affected
Source package: [openssh]
Details (8)
- 1:9.2p1-2+deb12u10 · amd64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u10 · arm64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · amd64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · arm64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · amd64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · arm64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
[openssh-tests]Affected
Source package: [openssh]
Details (8)
- 1:9.2p1-2+deb12u10 · amd64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u10 · arm64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · amd64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · arm64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · amd64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · arm64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
[ssh]Affected
Source package: [openssh]
Details (8)
- 1:9.2p1-2+deb12u10 · all · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u10 · all · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · all · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · all · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · all · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · all · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · all · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · all · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
[ssh-askpass-gnome]Affected
Source package: [openssh]
Details (8)
- 1:9.2p1-2+deb12u10 · amd64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u10 · arm64 · bookworm
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · amd64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:10.0p1-7~bpo12+1 · arm64 · bookworm-backports
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · amd64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u9 · arm64 · bookworm-security
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · amd64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm
- 1:9.2p1-2+deb12u7 · arm64 · bookworm-updates
  Affected
  dsa · openssh · debian · bookworm

Observed: Oct 23, 2026, 5:48:26 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]