USN-3946-1 — rssh vulnerabilities

Summary

It was discovered that rssh incorrectly handled certain command-line arguments
and environment variables. An authenticated user could bypass rssh's command
restrictions, allowing an attacker to run arbitrary commands.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 14.04 LTS 14.04:LTS	rssh	2.3.4-4+deb8u2ubuntu0.14.04.2
Ubuntu · 16.04 LTS 16.04:LTS	rssh	2.3.4-4+deb8u2ubuntu0.16.04.2
Ubuntu · 18.04 LTS 18.04:LTS	rssh	2.3.4-7ubuntu0.1

Vulnerabilities 3

Unscored —

CVE-2019-1000018

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection…

rssh rssh Ubuntu Alpine

Feb 4, 2019
Unscored —

CVE-2019-3463

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell …

Debian GNU/Linux rssh rssh rssh Ubuntu Alpine

Feb 6, 2019
Unscored —

CVE-2019-3464

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restr…

Debian GNU/Linux rssh rssh rssh Ubuntu Alpine

Feb 6, 2019

References

report
https://ubuntu.com/security/CVE-2019-3463
report
https://ubuntu.com/security/CVE-2019-3464
report
https://ubuntu.com/security/CVE-2019-1000018

rssh vulnerabilities

Summary

Fixed packages 3

Vulnerabilities 3

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection…

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell …

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restr…

References