CVE-2016-5725

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-5725

Severity

5.9

Medium

CVSS V3

Description

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

References

https://images.chainguard.dev/security/CGA-fvm3-r4cw-39rf
https://github.com/advisories/GHSA-q446-82vq-w674
http://packetstormsecurity.com/files/138809/jsch-0.1.53-Path-Traversal.html
http://seclists.org/fulldisclosure/2016/Sep/53
http://www.jcraft.com/jsch/ChangeLog
http://www.securityfocus.com/bid/93100
https://access.redhat.com/errata/RHSA-2017:3115
https://github.com/tintinweb/pub/tree/master/pocs/cve-2016-5725
https://www.exploit-db.com/exploits/40411/
https://lists.debian.org/debian-lts-announce/2020/04/msg00017.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com/security-alerts/cpujan2021.html
https://www.oracle.com/security-alerts/cpuoct2020.html
https://security-tracker.debian.org/tracker/CVE-2016-5725

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

The trusted source for open source

Talk to an expert

Privacy

Terms

CVE-2016-5725

Severity

Description

References

Affected packages

The trusted source for open source

Product

Solutions

Customers

Resources

Company