CVE-2023-6004
Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
Summary
Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
Original description
The description as published by the source.
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-6004 libssh Fixed in: 0.9.8-0+deb11u1
References
- advisory access.redhat.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory libssh.org
- report bugzilla.redhat.com
- web access.redhat.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org