CVE-2023-51385
Publication date 20 December 2023
Last updated 11 February 2025
Ubuntu priority
Cvss 3 Severity Score
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
Status
Package | Ubuntu Release | Status |
---|---|---|
openssh | 24.10 oracular |
Fixed 1:9.6p1-3ubuntu1
|
24.04 LTS noble |
Fixed 1:9.6p1-3ubuntu1
|
|
22.04 LTS jammy |
Fixed 1:8.9p1-3ubuntu0.6
|
|
20.04 LTS focal |
Fixed 1:8.2p1-4ubuntu0.11
|
|
18.04 LTS bionic |
Fixed 1:7.6p1-4ubuntu0.7+esm3
|
|
16.04 LTS xenial |
Fixed 1:7.2p2-4ubuntu2.10+esm6
|
|
14.04 LTS trusty | Ignored end of ESM support, was needs-triage | |
openssh-ssh1 | 24.10 oracular | Ignored |
24.04 LTS noble | Ignored | |
22.04 LTS jammy | Ignored | |
20.04 LTS focal | Ignored | |
18.04 LTS bionic | Ignored | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
mdeslaur
openssh-ssh1 is only provided for compatibility with old devices that cannot be upgraded to modern protocols. We will not be providing any security support for the openssh-ssh1 package as it is insecure and should be used in trusted environments only.
Severity score breakdown
Parameter | Value |
---|---|
Base score |
|
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | Low |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6565-1
- OpenSSH vulnerabilities
- 3 January 2024
- USN-6560-2
- OpenSSH vulnerabilities
- 11 January 2024
- USN-6560-3
- OpenSSH vulnerability
- 16 September 2024