Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

OpenSSH Before 10.3 Allows Sensitive Files to be Installed with Wrong Permissions

published 6 months ago
Summary

A security issue affects OpenSSH versions before 10.3, which could allow sensitive files to be installed with permissions that allow unauthorized access. This happens when a file is downloaded using SCP as the root user without preserving the original permissions. To fix this, upgrade to OpenSSH 10.3 or later.

What to do
  • Update juliabinarywrappers openssh_jll to version 10.3.1+0.
Affected software
Ecosystem VendorProductAffected versions
Julia juliabinarywrappers openssh_jll < 10.3.1+0
Fix: upgrade to 10.3.1+0
Original advisory text
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome...
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.1 High
Timeline
Published9 Apr 2026
Updated18 Jul 2026
First seen9 Apr 2026
Sources
JLSEC-2026-74 · OSV
Track software like this
Free during beta