High
Security advisory
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-12062
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:16 UTC · Revision 1
Source evidence
The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
osv:CVE-2020-12062
Complete source record
{
"id": "3af8eda05f95add63fa995e7ff9e42e00243d19542ce996c43a37aa5c94a0d90",
"url": "https://osv.dev/vulnerability/CVE-2020-12062",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-12062",
"summary": "The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that \"this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol\" and \"utimes does not fail under normal circumstances.",
"evidence": "osv:CVE-2020-12062",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-12062",
"aliases": [
"CVE-2020-12062"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/openssh/openssh-portable",
"type": "GIT",
"events": [
{
"introduced": "8aa3455b16fddea4c0144a7c4a1edb10ec67dcc8"
},
{
"last_affected": "8aa3455b16fddea4c0144a7c4a1edb10ec67dcc8"
},
{
"fixed": "955854cafca88e0cdcd3d09ca1ad4ada465364a1"
},
{
"fixed": "aad87b88fc2536b1ea023213729aaf4eaabe1894"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:openbsd:openssh:8.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.2"
},
{
"last_affected": "8.2"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "955854cafca88e0cdcd3d09ca1ad4ada465364a1"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "aad87b88fc2536b1ea023213729aaf4eaabe1894"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"8.2",
"V_8_2_P1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12062.json",
"vanir_signatures": [
{
"id": "CVE-2020-12062-39b5eba3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302129403808892202751107050716447255615",
"275137382540473504567894507747715995732",
"45176824089903249431708505459288988025",
"42650369721984932448816373549365574476",
"314108161380745870756091828391071409453",
"252639239344775007717805267459386561729",
"72105134252708737273865218759451754542"
]
},
"source": "https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1",
"target": {
"file": "scp.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-12062-5a382a4a",
"digest": {
"length": 7438,
"function_hash": "308835858213114162198892540639498415372"
},
"source": "https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894",
"target": {
"file": "scp.c",
"function": "sink"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-12062-bbe3b781",
"digest": {
"length": 7309,
"function_hash": "53767624059814337072386877210542493620"
},
"source": "https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1",
"target": {
"file": "scp.c",
"function": "sink"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-12062-dc39e314",
"digest": {
"threshold": 0.9,
"line_hashes": [
"302129403808892202751107050716447255615",
"61496626747140544398979270959802250337",
"105281468172136327410663188044829880047",
"293086554244749760996224232632839202874",
"195580148751312565129272299131552896937",
"62754827386723772314164487033068467017",
"91093795874406203199923314780689690889",
"80045310575686873502304491569063636326",
"216708028325650026613906611124598911895",
"267214818528553513843417207949989865888",
"158765245001692313972144118478747865578",
"63414735354029722476490127892069240261",
"314107255444949948815984305294921132903",
"201088216718883056700857280629973156629",
"192212028164403779901204360561621057224",
"286506792761042218734818531975141235256",
"312896476630618715842742833924651703324",
"259473706127982983889351032975980407183",
"83000181967295068208842514600926261038",
"298663435118826884884272883130815331165",
"340082788827716859391783667820415712955",
"326618909914868997460470207450912218422",
"99829469656728677142853516466680587890",
"230402224464303796741997104396757960968",
"320410734860795843535174816443548679230",
"267570367607961992878385030191633367489",
"107061597165021500066445911238415806697",
"289806356720044768963146637049321452513",
"260243960107050248855121312637325053785",
"194739225682844158562181970494530443265",
"34499920914559173517755965082450825738",
"230496892850040593828802571910537797660",
"74513331631071103180190260695109362823",
"50008340652810922499358525931181772376",
"120885392690054934491661619585679522125",
"287194043963274900998509721959613721900",
"44458747903698616006063348483371826694",
"316508546691672080059414059357830782303",
"233252030710543796505253211883348519163",
"251303294524522309215060758302019394472",
"261154285554809755028701011917230766619",
"47604260138662383895696611698600606594",
"82716757682974634598437456806798515326",
"339562628026380855405821253447149174583",
"174443632761763456194541611876468838629",
"72865323631324555086594722244066789044",
"155970464046432105937355881038114428248",
"252556976983114577220887832534745663516",
"82716757682974634598437456806798515326",
"339562628026380855405821253447149174583",
"280795950746436728426598436267220946453",
"94853005640295156301536530480763509522",
"153436855944483167225029325803028562593",
"105751830035293369313241438730120389474",
"72179151947409486518325703207179625135",
"175621170897981045447164479825797579092",
"277668653804583582479783918364773324982",
"113991484183080694382335885884042736886",
"168597542689955321354994213937711084361",
"240419536269667880525330408125200418703",
"33151099816884254792673513434906421922",
"224529968258468223378229755745745961869",
"152713584736817055945937143365665948725",
"211946117988160896391161643716436042818",
"316178308796585714024499955083089956470",
"280795950746436728426598436267220946453",
"18680688248253541108941255092917070201",
"131212689586534513628691939966476177107",
"222724721650718470349355510096094049112",
"260229717884042119955419045501957239876",
"298524835033959019491944943615422372491",
"208880212106049173201109273280066256456",
"20580524280090512475815308110071033145",
"331933004902524566911166121531619289335",
"300670216331995004139625650417842821291",
"207336144161194161842375081300721617949",
"77189386757872489944687781701598284719",
"293219870560737882010165752088878138796",
"269276677097489836684562413862894015645",
"144770580281188077559439423940497599709",
"283101901284502727108791913409430652930",
"212763019808253940086989854761979559026"
]
},
"source": "https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894",
"target": {
"file": "scp.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:26:25Z"
}
}
],
"modified": "2026-10-20T13:26:25.273708406Z",
"provider": "osv",
"references": [
"https://cert-portal.siemens.com/productcert/html/ssa-398330.html",
"https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894",
"https://www.openssh.com/txt/release-8.3",
"https://www.openwall.com/lists/oss-security/2020/05/27/1",
"https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-12062",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387685,
"published_at": "2020-06-01T16:15:14.26+00:00"
}