CVE-2016-3115: CRLF Injection
Last updated 24 July 2024
Other sources
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) doauthenticated1 and (2) sessionx11req functions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3115?
The severity of CVE-2016-3115 is considered to be high due to its potential to allow unauthorized shell-command execution.
How do I fix CVE-2016-3115?
To fix CVE-2016-3115, update OpenSSH to versions 1:8.4p1-5+deb11u3, 1:9.2p1-2+deb12u3, or 1:9.8p1-8.
Which versions of OpenSSH are affected by CVE-2016-3115?
CVE-2016-3115 affects OpenSSH versions prior to 7.2p2.
Can CVE-2016-3115 be exploited by remote users?
Yes, CVE-2016-3115 can be exploited by remote authenticated users through crafted X11 forwarding data.
What functions are related to the vulnerabilities in CVE-2016-3115?
The functions related to the vulnerabilities in CVE-2016-3115 are do_authenticated1 and session_x11_req.