In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For examp…
Medium CVSS 6.5
Summary
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Sources
- NVD DATABASE
Original Links
- http://seclists.org/fulldisclosure/2024/Mar/21
- http://www.openwall.com/lists/oss-security/2023/12/26/4 Mailing List
- https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a Patch
- https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html Mailing List
- https://security.gentoo.org/glsa/202312-17 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240105-0005/
- https://support.apple.com/kb/HT214084
- https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html Third Party Advisory
- https://www.debian.org/security/2023/dsa-5586 Third Party Advisory
- https://www.openssh.com/txt/release-9.6 Release Notes
- https://www.openwall.com/lists/oss-security/2023/12/18/2 Mailing List
- http://seclists.org/fulldisclosure/2024/Mar/21
- http://www.openwall.com/lists/oss-security/2023/12/26/4 Mailing List
- http://www.openwall.com/lists/oss-security/2025/10/07/1
- http://www.openwall.com/lists/oss-security/2025/10/12/1
- https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a Patch
- https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html Mailing List
- https://security.gentoo.org/glsa/202312-17 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240105-0005/
- https://support.apple.com/kb/HT214084
- https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html Third Party Advisory
- https://www.debian.org/security/2023/dsa-5586 Third Party Advisory
- https://www.openssh.com/txt/release-9.6 Release Notes
- https://www.openwall.com/lists/oss-security/2023/12/18/2 Mailing List
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-769027.html
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
Timeline
- nvd_ingest NVD