GHSA-jmqp-37m5-49whLowCVSS 3.5

sshproxy vulnerable to SSH option injection

Published
May 14, 2024
Last Modified
July 8, 2024

🔗 CVE IDs covered (1)

CVE-2024-34713 →

📋 Description

Impact

Any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted.

Patches

The problem is patched starting on version 1.6.3

Workarounds

The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.

References

🎯 Affected products1

  • go/github.com/cea-hpc/sshproxy:<= 1.6.2

🔗 References (5)