Description
In manager.c in ss-manager in shadowsocks-libev 3.1.0, improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic, related to the add_server, build_config, and construct_command_line functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | shadowsocks-libev | 3.1.0+ds-2 | — |
| Debian 12 | shadowsocks-libev | 3.1.0+ds-2 | — |
| Debian 9 | shadowsocks-libev | 2.6.3+ds-3+deb9u1 | DSA-4009-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | shadowsocks-libev | 3.3.5-1.9 | openSUSE-SU-2024:11379-1 |
Advisories 2
- DSA-4009-1 shadowsocks-libev - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11379-1 libshadowsocks-libev2-3.3.5-1.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/shadowsocks/shadowsocks-libev/commit/c67d275803dc6ea22c558d06b1f7ba9f94cd8de3
- https://github.com/shadowsocks/shadowsocks-libev/issues/1734
- https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/
- DSA-4009 vendor-advisory
- http://openwall.com/lists/oss-security/2017/10/13/2