Back to Database
Status published
Unknown
CVE-2017-15906
The process_open function in sftp-server.c in OpenSSH before 7.6 does...
Vulnerability Description
The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-15906
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.openssh.com/txt/release-7.6
- http://www.securityfocus.com/bid/101552
- https://github.com/openbsd/src/commit/a6981567e8e215acc1ef690c8dbb30f2d9b00a19
- https://security.gentoo.org/glsa/201801-05
- https://security.netapp.com/advisory/ntap-20180423-0004/
- https://access.redhat.com/errata/RHSA-2018:0980
- https://lists.debian.org/debian-lts-announce/2018/09/msg00010.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
More from openbsd
View All →CVE-2022-48437
An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1,...
Unknown
0
CVE-2022-27882
slaacd in OpenBSD 6.9 and 7.0 before 2022-03-22 has an...
High
7.5
CVE-2022-27881
engine.c in slaacd in OpenBSD 6.9 and 7.0 before 2022-02-21...
High
7.5
CVE-2021-46880
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata...
Unknown
0
CVE-2021-41617
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain...
High
7
Affected Vendor
openbsd
View all reports →Affected Software
openssh, sun zfs storage appliance kit, debian linux, active iq unified manager, cloud backup, clustered data ontap, data ontap edge, hci management node, oncommand unified manager core package, solidfire, steelstore cloud integrated storage, storage replication adapter for clustered data ontap, vasa provider for clustered data ontap, virtual storage console, cn1610 firmware, enterprise linux desktop, enterprise linux eus, enterprise linux server, enterprise linux server aus, enterprise linux server tus, enterprise linux workstation
Vulnerable Versions:
0, 8.8.6, 8.0, 9.7, 9.6, 6.0, 7.0, 7.6, 7.7
Timeline
Official Publish:
October 26th, 2017
Last Modified:
May 28th, 2026
Added to House:
July 20th, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.