CVE-2019-14889 Command injection in libssh

High 7.1 Published 10 Dec 2019 Updated 5 Aug 2024

Attackers can inject arbitrary commands via SCP paths in libssh, leading to remote code execution on the server if user input influences the path parameter.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-14889?

CVE-2019-14889 is a high-severity command injection vulnerability in Canonical Ubuntu Linux, published on 10 Dec 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.

Weakness: CWE-78

Which versions are affected by CVE-2019-14889?

It affects 6 products.

Linux distribution packages (26)

`libssh` SUSE:Linux Enterprise Desktop 12 SP4	All versions	`0.6.3-12.12.1`
`libssh` SUSE:Linux Enterprise Desktop 12 SP4	All versions	`0.6.3-12.9.1`
`libssh` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	All versions	`0.7.5-6.9.2`
`libssh` SUSE:Linux Enterprise High Performance Computing 15-LTSS	All versions	`0.7.5-6.9.2`
`libssh` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`0.7.5-6.6.1`
`libssh` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`0.7.5-6.9.2`
`libssh` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`0.8.7-10.6.2`
`libssh` SUSE:Linux Enterprise Module for Basesystem 15 SP1	All versions	`0.8.7-10.9.1`
`libssh` SUSE:Linux Enterprise Server 12 SP4	All versions	`0.6.3-12.12.1`
`libssh` SUSE:Linux Enterprise Server 12 SP4	All versions	`0.6.3-12.9.1`
`libssh` SUSE:Linux Enterprise Server 12 SP5	All versions	`0.8.7-3.3.1`
`libssh` SUSE:Linux Enterprise Server 12 SP5	All versions	`0.8.7-3.6.1`
`libssh` SUSE:Linux Enterprise Server 15-LTSS	All versions	`0.7.5-6.9.2`
`libssh` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`0.6.3-12.12.1`
`libssh` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`0.6.3-12.9.1`
`libssh` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`0.8.7-3.3.1`
`libssh` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`0.8.7-3.6.1`
`libssh` SUSE:Linux Enterprise Server for SAP Applications 15	All versions	`0.7.5-6.9.2`
`libssh` SUSE:Linux Enterprise Software Development Kit 12 SP4	All versions	`0.6.3-12.12.1`
`libssh` SUSE:Linux Enterprise Software Development Kit 12 SP4	All versions	`0.6.3-12.9.1`
`libssh` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`0.6.3-12.12.1`
`libssh` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`0.6.3-12.9.1`
`libssh` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`0.8.7-3.3.1`
`libssh` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`0.8.7-3.6.1`
`libssh` openSUSE:Leap 15.1	All versions	`0.8.7-lp151.2.6.1`
`libssh` openSUSE:Leap 15.1	All versions	`0.8.7-lp151.2.9.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Libssh Libssh, Opensuse Leap, Oracle Mysql Workbench.

How do I fix CVE-2019-14889?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-14889 being exploited?

There is no known exploitation of CVE-2019-14889 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as ALPINE-CVE-2019-14889, DEBIAN-CVE-2019-14889, DLA-2038-1, GHSA-mrxf-x73j-79wm, MGASA-2019-0402, SUSE-SU-2019:3267-1 and 11 more.