CVE-2019-14889

Name	CVE-2019-14889
Description	A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence the third parameter of the function, it would become possible for an attacker to inject arbitrary commands, leading to a compromise of the remote target.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2038-1, DLA-3437-1
Debian Bugs	946548

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libssh (PTS)	bullseye (security), bullseye	0.9.8-0+deb11u1	fixed
	bookworm, bookworm (security)	0.10.6-0+deb12u1	fixed
	trixie	0.11.2-1+deb13u1	fixed
	forky, sid	0.11.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libssh	source	jessie	0.6.3-4+deb8u4	DLA-2038-1
libssh	source	buster	0.8.7-1+deb10u2	DLA-3437-1
libssh	source	(unstable)	0.9.3-1		946548

Notes

https://www.libssh.org/security/advisories/CVE-2019-14889.txt
https://bugs.libssh.org/T181
The fix in libssh makes an update in x2goclient necessary, cf:
https://bugs.debian.org/947129
https://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=ce559d163a943737fe4160f7233925df2eee1f9a