REDHAT-BUG-2401960: Medium severity OpenSSH OpenSSH vulnerability
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. (A configuration file that provides a complete literal username is not categorized as an untrusted source.)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSSHto a version that resolves this vulnerability.Fixed in 10.1 - Configuration
When using ssh with ProxyCommand, ensure usernames cannot originate from untrusted command line inputs or %-sequence expansion of configuration files; avoid passing potentially attacker-controlled username strings to ssh.
OpenSSH ssh ProxyCommand = use only trusted, non-untrusted-origin usernames (avoid untrusted sources that could inject control characters)
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2401960?
The severity of REDHAT-BUG-2401960 is considered critical due to the potential for code execution.
How do I fix REDHAT-BUG-2401960?
To fix REDHAT-BUG-2401960, upgrade OpenSSH to version 10.1 or later where the vulnerability is addressed.
What vulnerability does REDHAT-BUG-2401960 describe?
REDHAT-BUG-2401960 describes a vulnerability in OpenSSH that allows control characters in usernames, which could lead to code execution.
Which versions of OpenSSH are affected by REDHAT-BUG-2401960?
OpenSSH versions prior to 10.1 are affected by REDHAT-BUG-2401960.
What components are involved in the vulnerability described by REDHAT-BUG-2401960?
The components involved include usernames derived from untrusted sources like command lines and configuration file expansions.