CVE-2019-3464
Description
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
10.26
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-7ubuntu0.1_i386.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-7ubuntu0.1_amd64.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-8ubuntu0.2_i386.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-8ubuntu0.2_amd64.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-4+deb8u2ubuntu0.14.04.2_i386.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-4+deb8u2ubuntu0.14.04.2_amd64.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-4+deb8u2ubuntu0.16.04.2_i386.deb | Linux |
| Restricted shell allowing scp, sftp, cvs, svn, rsync or rdist (USN-3946-1) rssh_2.3.4-4+deb8u2ubuntu0.16.04.2_amd64.deb | Linux |
| rssh security update(DSA-4382-1) rssh_2.3.4-5+deb9u2_i386.deb | Linux |
| rssh security update(DSA-4382-1) rssh_2.3.4-5+deb9u2_amd64.deb | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234