GHSA-jmqp-37m5-49wh

Suggest an improvement
Source
https://github.com/advisories/GHSA-jmqp-37m5-49wh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-jmqp-37m5-49wh/GHSA-jmqp-37m5-49wh.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-jmqp-37m5-49wh
Aliases
Related
Published
2024-05-14T20:16:33Z
Modified
2024-06-04T16:58:44.213231Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
sshproxy vulnerable to SSH option injection
Details

Impact

Any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted.

Patches

The problem is patched starting on version 1.6.3

Workarounds

The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.

References

Database specific 
{
    "nvd_published_at": "2024-05-14T16:17:27Z",
    "cwe_ids": [
        "CWE-77"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T20:16:33Z"
}
References

Affected packages

Go / github.com/cea-hpc/sshproxy

Package

Name
github.com/cea-hpc/sshproxy
View open source insights on deps.dev
Purl
pkg:golang/github.com/cea-hpc/sshproxy

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.6.3

Database specific 

{
    "last_known_affected_version_range": "<= 1.6.2"
}