Veracode Vulnerability DatabaseVERACODE:31030Arbitrary Command Execution
EPSS
Percentile
83.3%
rssh is vulnerable to arbitrary command execution. An attacker is able to bypass restrictions imposed by rssh due to insufficient sanitization of environment variables that are passed to rsync, resulting in the execution of arbitrary shell commands.
References
seclists.org/fulldisclosure/2021/May/78
www.securityfocus.com/bid/106839
lists.debian.org/debian-lts-announce/2019/02/msg00007.html
lists.fedoraproject.org/archives/list/[email protected]/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
lists.fedoraproject.org/archives/list/[email protected]/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
lists.fedoraproject.org/archives/list/[email protected]/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
secdb.alpinelinux.org/edge/main.yaml
secdb.alpinelinux.org/v3.13/main.yaml
secdb.alpinelinux.org/v3.14/main.yaml
security.gentoo.org/glsa/202007-29
tracker.debian.org/news/1026713/accepted-rssh-234-5deb9u2-source-amd64-into-stable-embargoed-stable/
usn.ubuntu.com/3946-1/
www.debian.org/security/2019/dsa-4382
Related
