https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:51:41 +0000 https://vulnerability.circl.lu/vuln/cve-2020-12062 <p>The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client&#39;s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that &#34;this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol&#34; and &#34;utimes does not fail under normal circumstances.</p> <p>The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client&#39;s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that &#34;this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol&#34; and &#34;utimes does not fail under normal circumstances.</p> https://vulnerability.circl.lu/vuln/cve-2020-12062