CVE-2020-36617

CRITICO 9.8CVE-2020-36617 · Published 18/12/2022 · updated 17/06/2026

In breve

CVE-2020-36617 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda sftpserver (greenend).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.59%, superiore al 48.5% delle vulnerabilità.
Correzione: aggiornare a 2 o successiva.

Package	Affected versions	Patched versions
sftpserver greenend	`< 2`	`2`

Description

A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models.

References

ewxrjk/sftpserver commit bf4032f · Patch
vuldb.com · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free