CVE-2023-51385

2023-12-1819:15:08

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-51385

ssh

openssh

command injection

user name

host name

shell metacharacters

git

repository

submodule

unix

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

7.2 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.8%

JSON

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

OSVersionArchitecturePackageVersionFilename
Debian12allopenssh< 1:9.2p1-2+deb12u2openssh_1:9.2p1-2+deb12u2_all.deb
Debian11allopenssh< 1:8.4p1-5+deb11u3openssh_1:8.4p1-5+deb11u3_all.deb
Debian999allopenssh< 1:9.6p1-1openssh_1:9.6p1-1_all.deb
Debian13allopenssh< 1:9.6p1-1openssh_1:9.6p1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	openssh	< 1:9.2p1-2+deb12u2	openssh_1:9.2p1-2+deb12u2_all.deb
Debian	11	all	openssh	< 1:8.4p1-5+deb11u3	openssh_1:8.4p1-5+deb11u3_all.deb
Debian	999	all	openssh	< 1:9.6p1-1	openssh_1:9.6p1-1_all.deb
Debian	13	all	openssh	< 1:9.6p1-1	openssh_1:9.6p1-1_all.deb