CVE-2024-34713

Source
https://nvd.nist.gov/vuln/detail/CVE-2024-34713
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-34713.json
Aliases
Published
2024-05-14T16:17:27Z
Modified
2024-05-19T02:24:46.895678Z
Summary
[none]
Details

sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.

References

Affected packages

Git / github.com/cea-hpc/sshproxy

Affected ranges

Type
GIT
Repo
https://github.com/cea-hpc/sshproxy
Events
Introduced
0The exact introduced commit is unknown
Fixed

Affected versions

v0.*

v0.1.0
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.4.5

v1.*

v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.3.5
v1.3.6
v1.3.7
v1.3.8
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2