CVE-2014-2532: Input Validation
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshdconfig, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:8.4p1-5+deb11u3Fixed in 1:8.4p1-5+deb11u4Fixed in 1:9.2p1-2+deb12u5Fixed in 1:10.0p1-2 - Upgrade
Upgrade
OpenSSH sshdto a version that resolves this vulnerability.Fixed in 6.6 - Configuration
For OpenSSH sshd_config AcceptEnv directives, avoid wildcard usage in AcceptEnv patterns (e.g., do not rely on substring/wildcard matching) so that intended environment restrictions cannot be bypassed.
sshd_config (OpenSSH sshd) AcceptEnv = Do not use wildcard patterns; use exact environment variable names only
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2532?
CVE-2014-2532 has a medium severity rating as it allows attackers to bypass intended environment restrictions.
How do I fix CVE-2014-2532?
To fix CVE-2014-2532, upgrade OpenSSH to version 6.6 or later where the wildcard issue has been addressed.
Which versions of OpenSSH are affected by CVE-2014-2532?
CVE-2014-2532 affects OpenSSH versions prior to 6.6, including 6.0 through 6.5.
Can CVE-2014-2532 allow remote code execution?
CVE-2014-2532 does not directly allow remote code execution, but it can facilitate unauthorized environment variable manipulation.
Is CVE-2014-2532 specific to any operating systems?
CVE-2014-2532 affects OpenSSH installations across multiple operating systems, including Debian and Oracle systems.