Nixpkgs security tracker
Activity log
- Created suggestion
Libssh: improper sanitation of paths received from scp servers
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.
References
Affected products
Matching in nixpkgs
pkgs.libssh
SSH client library
pkgs.libssh2
Client-side C library implementing the SSH2 protocol
pkgs.haskellPackages.libssh
libssh bindings
pkgs.haskellPackages.libssh2
FFI bindings to libssh2 SSH2 client library (http://libssh2.org/)
-
nixos-unstable 0.2.0.9-unstable-2025-04-03
- nixpkgs-unstable 0.2.0.9-unstable-2025-04-03
- nixos-unstable-small 0.2.0.9-unstable-2025-04-03
pkgs.haskellPackages.libssh2-conduit
Conduit wrappers for libssh2 FFI bindings (see libssh2 package)
pkgs.python312Packages.ansible-pylibssh
None
pkgs.python313Packages.ansible-pylibssh
Python bindings to client functionality of libssh specific to Ansible use case
pkgs.python314Packages.ansible-pylibssh
Python bindings to client functionality of libssh specific to Ansible use case
pkgs.tests.pkg-config.defaultPkgConfigPackages.libssh2
Test whether libssh2-1.11.1 exposes pkg-config modules libssh2
Package maintainers
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@wfdewith Wim de With <wf@dewith.io>
-
@mpscholten Marc Scholten <marc@digitallyinduced.com>