GitHub Advisoryadvisory · Go
GHSA-jmqp-37m5-49wh sshproxy vulnerable to SSH option injection
LOW
Official page ↗
- Aliases
- CVE-2024-34713
- Ecosystem
- Go
- Packages
- github.com/cea-hpc/sshproxy
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-77
- Reviewed
- 2024-05-14
Affected packages
• Go github.com/cea-hpc/sshproxy: < 1.6.3 → fixed in 1.6.3
Description
Impact
Any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`.
All versions of `sshproxy` are impacted.
Patches
The problem is patched starting on version 1.6.3
Workarounds
The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.
References
Related
Alias · CVE (1)
- CVE-2024-34713 sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. vulnerability
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh web
- https://nvd.nist.gov/vuln/detail/CVE-2024-34713 advisory
- https://github.com/cea-hpc/sshproxy/commit/3b8bccc874dc4ca2c80c956cad65722abb46f0b9 web
- https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580 web
- https://github.com/cea-hpc/sshproxy package