openssh/openssh-9.9p1-scp-remote-glob.patch
Zoltan Fridrich 96e0821266 Fix CVE-2026-59996
Fix remote glob result of ".." causing files to be placed
in unintended parent directories when scp performs
remote-to-remote copy via the local host

Resolves: RHEL-193172

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>
2026-07-14 11:52:47 +02:00

15 lines
433 B
Diff

diff --color -ruNp a/scp.c b/scp.c
--- a/scp.c 2026-07-14 11:40:47.754600847 +0200
+++ b/scp.c 2026-07-14 11:43:04.077524517 +0200
@@ -2070,6 +2070,10 @@ throughlocal_sftp(struct sftp_conn *from
goto out;
}
+ /* Special handling for source of '..' */
+ if (strcmp(filename, "..") == 0)
+ filename = "."; /* Download to dest, not dest/.. */
+
if (targetisdir)
abs_dst = sftp_path_append(target, filename);
else