Vulnerabilites related to ovh - the-bastion
Vulnerability from fkie_nvd
Published
2023-11-08 16:15
Modified
2024-11-21 08:26
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.6 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Summary
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.
References
security-advisories@github.comhttps://github.com/ovh/the-bastion/releases/tag/v3.14.15Patch
security-advisories@github.comhttps://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5xMitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/ovh/the-bastion/releases/tag/v3.14.15Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5xMitigation, Vendor Advisory
Impacted products
Vendor Product Version
ovh the-bastion *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ovh:the-bastion:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A4A16733-F993-429F-B56C-6161B82D25C3",
              "versionEndExcluding": "3.14.15",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don\u0027t honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15."
    },
    {
      "lang": "es",
      "value": "The Bastion proporciona autenticaci\u00f3n, autorizaci\u00f3n, trazabilidad y auditabilidad para accesos SSH. Los complementos SCP y SFTP no respetan JIT MFA basado en grupos. Establecer una conexi\u00f3n SCP/SFTP a trav\u00e9s de The Bastion por medio de un acceso grupal donde se aplica MFA no requiere ning\u00fan factor adicional. Este comportamiento anormal solo se aplica a JIT MFA por grupo. Otros tipos de configuraci\u00f3n de MFA, como Immediate MFA, JIT MFA por complemento y JIT MFA por cuenta, no se ven afectados. Este problema se solucion\u00f3 en la versi\u00f3n 3.14.15."
    }
  ],
  "id": "CVE-2023-45140",
  "lastModified": "2024-11-21T08:26:25.670",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-11-08T16:15:09.800",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ovh/the-bastion/releases/tag/v3.14.15"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ovh/the-bastion/releases/tag/v3.14.15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

CVE-2025-59339 (GCVE-0-2025-59339)
Vulnerability from cvelistv5
Published
2025-09-17 17:50
Modified
2025-09-17 18:09
Severity ?
4.4 (Medium) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE
  • CWE-325 - Missing Cryptographic Step
Summary
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.
References
https://github.com/ovh/the-bastion/security/advisories/GHSA-h66q-g57p-rgg6x_refsource_CONFIRM
https://github.com/ovh/the-bastion/commit/9bc85ec3f4b724f903773ba64909777c4826a13fx_refsource_MISC
Impacted products
Vendor Product Version
ovh the-bastion Version: < 3.22.00
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-17T18:08:36.241076Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-17T18:09:55.732Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "the-bastion",
          "vendor": "ovh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.22.00"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-325",
              "description": "CWE-325: Missing Cryptographic Step",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T17:50:34.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ovh/the-bastion/security/advisories/GHSA-h66q-g57p-rgg6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ovh/the-bastion/security/advisories/GHSA-h66q-g57p-rgg6"
        },
        {
          "name": "https://github.com/ovh/the-bastion/commit/9bc85ec3f4b724f903773ba64909777c4826a13f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ovh/the-bastion/commit/9bc85ec3f4b724f903773ba64909777c4826a13f"
        }
      ],
      "source": {
        "advisory": "GHSA-h66q-g57p-rgg6",
        "discovery": "UNKNOWN"
      },
      "title": "The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-59339",
    "datePublished": "2025-09-17T17:50:34.877Z",
    "dateReserved": "2025-09-12T12:36:24.635Z",
    "dateUpdated": "2025-09-17T18:09:55.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45140 (GCVE-0-2023-45140)
Vulnerability from cvelistv5
Published
2023-11-08 15:26
Modified
2024-09-12 19:10
Severity ?
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE
  • CWE-306 - Missing Authentication for Critical Function
Summary
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.
References
https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5xx_refsource_CONFIRM
https://github.com/ovh/the-bastion/releases/tag/v3.14.15x_refsource_MISC
Impacted products
Vendor Product Version
ovh the-bastion Version: >= 3.0.0, <= 3.14.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:14:19.158Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x"
          },
          {
            "name": "https://github.com/ovh/the-bastion/releases/tag/v3.14.15",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/ovh/the-bastion/releases/tag/v3.14.15"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-45140",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T14:25:53.100320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T19:10:42.145Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "the-bastion",
          "vendor": "ovh",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c= 3.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don\u0027t honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-08T15:26:26.584Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x"
        },
        {
          "name": "https://github.com/ovh/the-bastion/releases/tag/v3.14.15",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ovh/the-bastion/releases/tag/v3.14.15"
        }
      ],
      "source": {
        "advisory": "GHSA-pr4q-w883-pf5x",
        "discovery": "UNKNOWN"
      },
      "title": "Group-based JIT MFA bypass on scp and sftp in The Bastion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2023-45140",
    "datePublished": "2023-11-08T15:26:26.584Z",
    "dateReserved": "2023-10-04T16:02:46.329Z",
    "dateUpdated": "2024-09-12T19:10:42.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}