# CVE-2017-15906: openssh-sftp-server: The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readon...

CVE-2017-15906 is fixed in 5 products on 1 platform, first by openssh-client 1:7.6p1-4, released October 24, 2017. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2017-15906
- Priority: Routine
- CVSS: n/a (Low)
- EPSS: 0.0336
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 24, 2017

## Description

The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | openssh-client Ubuntu 18.04.6 LTS (bionic) | 1:7.6p1-4 | [openssh-client 1:7.6p1-4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssh-client-1-7.6p1-4.md) | Oct 24, 2017 |
| Linux | openssh-server Ubuntu 18.04.6 LTS (bionic) | 1:7.6p1-4 | [openssh-server 1:7.6p1-4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssh-server-1-7.6p1-4.md) | Oct 24, 2017 |
| Linux | openssh-sftp-server Ubuntu 18.04.6 LTS (bionic) | 1:7.6p1-4 | [openssh-sftp-server 1:7.6p1-4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssh-sftp-server-1-7.6p1-4.md) | Oct 24, 2017 |
| Linux | ssh Ubuntu 18.04.6 LTS (bionic) | 1:7.6p1-4 | [ssh 1:7.6p1-4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ssh-1-7.6p1-4.md) | Oct 24, 2017 |
| Linux | ssh-askpass-gnome Ubuntu 18.04.6 LTS (bionic) | 1:7.6p1-4 | [ssh-askpass-gnome 1:7.6p1-4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-ssh-askpass-gnome-1-7.6p1-4.md) | Oct 24, 2017 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo