Description
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Debian GNU/Linux | rssh | All versions before 2.3.4-5+deb9u2 and 2.3.4-10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | rssh | 2.3.4-5+deb9u2 | DSA-4382-1 |
| Debian 8 | rssh | 2.3.4-4+deb8u2 | DLA-1660-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | rssh | 2.3.4-7ubuntu0.1 | USN-3946-1 |
| Ubuntu 16.04 LTS | rssh | 2.3.4-4+deb8u2ubuntu0.16.04.2 | USN-3946-1 |
| Ubuntu 14.04 LTS | rssh | 2.3.4-4+deb8u2ubuntu0.14.04.2 | USN-3946-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.22 | rssh | 2.3.4-r1 | — |
| Alpine v3.21 | rssh | 2.3.4-r1 | — |
| Alpine v3.20 | rssh | 2.3.4-r1 | — |
| Alpine v3.19 | rssh | 2.3.4-r1 | — |
| Alpine v3.18 | rssh | 2.3.4-r1 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.17 | rssh | 2.3.4-r1 | — |
| Alpine v3.16 | rssh | 2.3.4-r1 | — |
| Alpine v3.15 | rssh | 2.3.4-r1 | — |
| Alpine v3.14 | rssh | 2.3.4-r1 | — |
| Alpine v3.13 | rssh | 2.3.4-r1 | — |
Advisories 4
- DSA-4382-1 rssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1660-1 rssh - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3946-1 rssh vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- ICSMA-19-311-02 Medtronic Valleylab FT10 and FX8 CISA ICS & IT advisories · Nov 7, 2019
References
- DSA-4382 vendor-advisory
- [debian-lts-announce] 20190206 [SECURITY] [DLA 1660-1] rssh security update mailing-list
- 106839 vdb-entry
- https://tracker.debian.org/news/1026713/accepted-rssh-234-5deb9u2-source-amd64-into-stable-embargoed-stable/
- USN-3946-1 vendor-advisory
- FEDORA-2019-e47add6b2b vendor-advisory
- FEDORA-2019-d1487c13ac vendor-advisory
- FEDORA-2019-bfb407659e vendor-advisory
- GLSA-202007-29 vendor-advisory
- 20210526 KL-001-2021-007: CommScope Ruckus IoT Controller Undocumented Account mailing-list