A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.

A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected.

openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding openssh: openssh: sftp can write outside the destination directory from a server-supplied path openssh: openssh: '$' and '\' in a command-line username expand through %u openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels openssh: openssh: a compressed payload can expand past the maximum packet size