CVE-2019-1000018

Published: 04 February 2019

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
rssh Launchpad, Ubuntu, Debian	Upstream	Released (2.3.4-9)



	Ubuntu 18.04 LTS (Bionic Beaver)	Released (2.3.4-7ubuntu0.1)
	Ubuntu 16.04 LTS (Xenial Xerus)	Released (2.3.4-4+deb8u2build0.16.04.2)
	Ubuntu 14.04 ESM (Trusty Tahr)	Released (2.3.4-4+deb8u2build0.14.04.2)

Notes

Author	Note
sbeattie	this fix introduced a regression, see debian bug

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919623

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM