The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2019_3702 advisory.

    * openssh: scp client improper directory name validation (CVE-2018-20685)

    * openssh: Improper validation of object names allows malicious server to overwrite files via scp client     (CVE-2019-6111)

    * openssh: Missing character encoding in progress display allows for spoofing of scp client output     (CVE-2019-6109)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0188 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2018-20685:
    In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions     via the filename of . or an empty filename. The impact is modifying the permissions of the target     directory on the client side.

    CVE-2019-6109:
    An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a     malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client     output, e.g., by using ANSI control codes to hide additional files being transferred. This affects     refresh_progress_meter() in progressmeter.c.

    CVE-2019-6111:
    An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the     server chooses which files/directories are sent to the client. However, the scp client only performs     cursory validation of the object name returned (only directory traversal attacks are prevented). A     malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client     target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as     well (for example, to overwrite the .ssh/authorized_keys file).

    CVE-2020-14145:
    The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in     the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts     (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and     8.6 are also affected.

    CVE-2021-41617:
    sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows     privilege escalation because supplemental groups are not initialized as expected. Helper programs for     AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group     memberships of the sshd process, if the configuration specifies running the command as a different user.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openssh fixes the following issues :

Security issues fixed :

CVE-2018-20685: Fixed an issue where scp client allows remote SSH servers to bypass intended access restrictions (bsc#1121571)

CVE-2019-6109: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate terminal output via the object name, e.g. by inserting ANSI escape sequences (bsc#1121816)

CVE-2019-6110: Fixed an issue where the scp client would allow malicious remote SSH servers to manipulate stderr output, e.g. by inserting ANSI escape sequences (bsc#1121818)

CVE-2019-6111: Fixed an issue where the scp client would allow malicious remote SSH servers to execute directory traversal attacks and overwrite files (bsc#1121821)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0470 advisory.

    This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.2. It addresses 21 CVEs:
    CVE-2006-4924, CVE-2023-51385, CVE-2016-6210, CVE-2016-1908, CVE-2023-48795, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
357048	Rocky Linux 8 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (crlsa-2019_3702)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	medium
236225	Alibaba Cloud Linux 3 : 0188: openssh (ALINUX3-SA-2022:0188)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
121296	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2019:0126-1)	Nessus	SuSE Local Security Checks	2019/1/22	2022/5/24	medium
354271	Rocky Linux 9.2 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0470)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical

检测

插件搜索

medium

high

medium

critical