sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy
can inject options to the ssh
command executed by sshproxy
. All versions of sshproxy
are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command
option in sshproxy.yaml
, but it's rarely relevant.