Ubuntu.comUB:CVE-2023-51385CVE-2023-51385
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
7.5 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
67.8%
In ssh in OpenSSH before 9.6, OS command injection might occur if a user
name or host name has shell metacharacters, and this name is referenced by
an expansion token in certain situations. For example, an untrusted Git
repository can have a submodule with shell metacharacters in a user name or
host name.
Notes
| Author | Note |
|---|---|
| seth-arnold | openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment. |
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 18.04 | noarch | openssh | < 1:7.6p1-4ubuntu0.7+esm3 | UNKNOWN |
| ubuntu | 20.04 | noarch | openssh | < 1:8.2p1-4ubuntu0.11 | UNKNOWN |
| ubuntu | 22.04 | noarch | openssh | < 1:8.9p1-3ubuntu0.6 | UNKNOWN |
| ubuntu | 23.04 | noarch | openssh | < 1:9.0p1-1ubuntu8.7 | UNKNOWN |
| ubuntu | 23.10 | noarch | openssh | < 1:9.3p1-1ubuntu3.2 | UNKNOWN |
| ubuntu | 24.04 | noarch | openssh | < 1:9.6p1-3ubuntu1 | UNKNOWN |
| ubuntu | 14.04 | noarch | openssh | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | openssh | < 1:7.2p2-4ubuntu2.10+esm5 | UNKNOWN |
| ubuntu | 18.04 | noarch | openssh-ssh1 | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | openssh-ssh1 | < any | UNKNOWN |
References
launchpad.net/bugs/cve/CVE-2023-51385
nvd.nist.gov/vuln/detail/CVE-2023-51385
security-tracker.debian.org/tracker/CVE-2023-51385
ubuntu.com/security/notices/USN-6560-2
ubuntu.com/security/notices/USN-6565-1
www.cve.org/CVERecord?id=CVE-2023-51385
www.openssh.com/txt/release-9.6
www.openwall.com/lists/oss-security/2023/12/18/2
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
7.5 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
67.8%