CVE-2023-6004 — Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname

Affected: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7

A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.

USN-6592-1 — libssh vulnerabilities

Affected: Ubuntu:20.04:LTS: libssh, Ubuntu:22.04:LTS: libssh

It was discovered that libssh incorrectly handled the ProxyCommand and the ProxyJump features. A remote attacker could possibly use this issue to inject malicious code into the command of the features mentioned through the hostname parameter. (CVE-2023-6004)

It was discovered that libssh incorrectly handled return codes when performing message digest operations. A remote attacker could possibly use this issue to cause libssh to crash, obtain sensitive information, or execute arbitrary code. (CVE-2023-6918)

Most recent entries from all

CVE-2023-6004 — Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname

USN-6592-1 — libssh vulnerabilities