UBUNTU-CVE-2024-52308

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2024-52308
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52308.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-52308
Related
Published
2024-11-14T23:15:00Z
Modified
2024-11-28T04:31:40Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using gh codespace ssh or gh codespace logs commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the default devcontainer image . GitHub CLI retrieves SSH connection details, such as remote username, which is used in executing ssh commands for gh codespace ssh or gh codespace logs commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects ssh arguments within the SSH connection details. gh codespace ssh and gh codespace logs commands could execute arbitrary code on the user's workstation if the remote username contains something like -oProxyCommand="echo hacked" #. The -oProxyCommand flag causes ssh to execute the provided command while # shell comment causes any other ssh arguments to be ignored. In 2.62.0, the remote username information is being validated before being used.

References

Affected packages

Ubuntu:24.10 / gh

Package

Name
gh
Purl
pkg:deb/ubuntu/gh?arch=src?distro=oracular

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.46.0-1ubuntu0.2

Affected versions

2.*

2.45.0-1build1
2.46.0-1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "binary_version": "2.46.0-1ubuntu0.2",
            "binary_name": "gh"
        },
        {
            "binary_version": "2.46.0-1ubuntu0.2",
            "binary_name": "gh-dbgsym"
        }
    ],
    "priority_reason": "code execution"
}

Ubuntu:24.04:LTS / gh

Package

Name
gh
Purl
pkg:deb/ubuntu/gh?arch=src?distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.27.0+dfsg1-1build1
2.30.0-2
2.35.0-1
2.40.1+dfsg1-1
2.42.1-1
2.43.1-1
2.44.1-1
2.44.1-2
2.45.0-1
2.45.0-1build1
2.45.0-1ubuntu0.1
2.45.0-1ubuntu0.2

Ecosystem specific 

{
    "ubuntu_priority": "high",
    "priority_reason": "code execution"
}

Ubuntu:Pro:24.04:LTS / gh

Package

Name
gh
Purl
pkg:deb/ubuntu/gh?arch=src?distro=esm-apps/noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.45.0-1ubuntu0.2+esm1

Affected versions

2.*

2.27.0+dfsg1-1build1
2.30.0-2
2.35.0-1
2.40.1+dfsg1-1
2.42.1-1
2.43.1-1
2.44.1-1
2.44.1-2
2.45.0-1
2.45.0-1build1
2.45.0-1ubuntu0.1
2.45.0-1ubuntu0.2

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "binary_version": "2.45.0-1ubuntu0.2+esm1",
            "binary_name": "gh"
        },
        {
            "binary_version": "2.45.0-1ubuntu0.2+esm1",
            "binary_name": "gh-dbgsym"
        }
    ],
    "priority_reason": "code execution"
}