Lucene search

K
cvelistMitreCVELIST:CVE-2023-35812
HistoryApr 03, 2024 - 12:00 a.m.

CVE-2023-35812

2024-04-0300:00:00
mitre
raw.githubusercontent.com
4
amazon linux
openssh 7.4
cve-2023-35812
incomplete fix

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.4%

An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 within these specific packages. The fix had only covered cases where an absolute path is passed to scp. When a relative path is used, there is no verification that the name of a file received by the client matches the file requested. Fixed packages are available with numbers 7.4p1-22.78.amzn1 and 7.4p1-22.amzn2.0.2.