{"action":"Upgrade netkit-rsh to 0.17-20 or later.","affected":[{"fixed":"0.17-20","introduced":"0"}],"component":"netkit-rsh","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["0.17-20"],"id":"tcs_01M5NE9S3TATQTX24JF48Y1AJD","modified_at":"2026-09-21T07:03:23.461100520Z","published_at":"2019-01-31T18:29:00.913Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-7282","https://security-tracker.debian.org/tracker/CVE-2019-7282"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-7282","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-7282"}],"summary":"In NetKit through 0.17, rcp.c in the rcp client allows remote rsh servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of"}