Bug 920722 (CVE-2023-51385)

Summary:	<net-misc/openssh-9.6_p1: ProxyCommand Unexpected Code Execution Vulnerability
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	base-system
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://threatprotect.qualys.com/2023/12/26/ssh-proxycommand-unexpected-code-execution-vulnerability-cve-2023-51385/
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=920724
Whiteboard:	A2 [glsa+]
Package list:		Runtime testing required:	---
Bug Depends on:	920725
Bug Blocks:

Description Sam James archtester

2023-12-26 17:06:24 UTC

* https://threatprotect.qualys.com/2023/12/26/ssh-proxycommand-unexpected-code-execution-vulnerability-cve-2023-51385/
* https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html

"""
SSH ProxyCommand allows users to proxy an SSH connection to a target. SSH ProxyCommand specifies the command to use to connect to the server. Arguments to this directive may contain tokens like %h and %u, which refer to hostname and username, respectively. The SSH Proxy feature also provides visibility into SSH traffic and control over the commands users execute in the SSH channel.
"""

Comment 1 Larry the Git Cow gentoo-dev

2023-12-28 02:22:13 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=3dfe782899716a3480c9481c69bca8c231c663a7

commit 3dfe782899716a3480c9481c69bca8c231c663a7
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-12-28 02:21:28 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-12-28 02:22:09 +0000

    [ GLSA 202312-17 ] OpenSSH: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/920292
    Bug: https://bugs.gentoo.org/920722
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Sam James <sam@gentoo.org>

 glsa-202312-17.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)