CVE-2020-15778 @ morris

"CVE-2020-15778"
"openssh-7.4p1-23.0.5.el7_9.tuxcare.els3"
"openssh-clients-7.4p1-23.0.5.el7_9.tuxcare.els3"
"openssh-server-7.4p1-23.0.5.el7_9.tuxcare.els3"
"Am I vulnerable?"

Status

new

Priority

8.9

Match score

4.0

Risk

RCE priv:user

CVSS

7.4 HIGH

Reason

cpe: openssh; pkgs: openssh, openssh-clients, openssh-server; version: in-range: openssh-7.4p1-23.0.5.el7_9.tuxcare.els3, openssh-clients-7.4p1-23.0.5.el7_9.tuxcare.els3, openssh-server-7.4p1-23.0.5.el7_9.tuxcare.els3; risk:rce

Created

2026-10-15T10:20:43Z

Updated

2026-10-20T10:18:51Z

Package interrogation (copy)

Run on the host — click to copy a command. RPM

Package	Commands
openssh-7.4p1-23.0.5.el7_9.tuxcare.els3
openssh-clients-7.4p1-23.0.5.el7_9.tuxcare.els3
openssh-server-7.4p1-23.0.5.el7_9.tuxcare.els3

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: openssh · openssh-clients · openssh-server

System	Matches	Ticket for CVE-2020-15778
morris	openssh-clients 7.4p1	new open
mufasa	openssh-clients 7.4p1	new open

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVE	CVSS	Systems	Status	Matched	Already related
CVE-2023-38408	9.8	Archive, Janus, Library, Saiph, morris …	new	openssh-clients	—
CVE-2026-3497	7.5	Archive, Janus, Library, Saiph, morris …	new	openssh-clients	—
CVE-2023-51767	7.0	Archive, Bullseye, Helios, Janus, Library …	new	openssh-clients	—

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

CloudLinux release 7.9 (Boris Yegorov) (7.9) · cloudlinux

Arch

x86_64

kernel_release

uname -r → 3.10.0-962.3.2.lve1.5.89.el7.x86_64

kernel_version

uname -v → #1 SMP Thu Jul 9 15:55:31 UTC 2026

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
mufasa	new	8.9	2026-10-20T10:18:51Z	Open
Library	new	3.72	2026-10-20T10:18:51Z	Open
Archive	new	2.61	2026-10-20T10:18:51Z	Open
Janus	new	2.61	2026-10-20T10:18:51Z	Open
Saiph	new	2.61	2026-10-20T10:18:51Z	Open

Description

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Update status

Add note only

References

NVD: CVE-2020-15778