OS Command Injection in OpenSSH - CVE-2023-6004

Vulnerability identifier: #VU84538

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6004

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in OpenSSH client. If an invalid user or hostname that contained shell metacharacters was passed to ssh(1), and a ProxyCommand, LocalCommand directive or "match exec" predicate referenced the user or hostname via %u, %h or similar expansion token, then an attacker who could supply arbitrary user/hostnames to ssh(1) could potentially perform command injection depending on what quoting was present in the user-supplied ssh_config(5) directive.

OpenSSH
Debian Linux
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Fedora
libssh
IBM MQ Operator
Migration Toolkit for Runtimes
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift distributed tracing (RHOSDT)
IBM Cloud Transformation Advisor
App Connect Enterprise Certified Container
Dell Secure Connect Gateway
IBM Power Hardware Management Console (HMC)
Azure Stack
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
webMethods Managed File Transfer
PowerStore X
PowerStore T
Storage Resource Manager
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Storage Protect Plus Server
EMC Cloud Tiering Appliance
libssh-gcrypt-4 (Ubuntu package)
libssh-4 (Ubuntu package)
libssh-help
libssh-debuginfo
libssh-devel
libssh-debugsource
libssh
libssh-config
libssh-doc
libssh (Red Hat package)
libssh (Debian package)
libssh4-32bit
libssh4
libssh4-debuginfo
libssh4-debuginfo-32bit
libssh4-32bit-debuginfo
libssh4-64bit-debuginfo
libssh4-64bit
net-libs/libssh
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Red Hat OpenShift GitOps
Red Hat OpenShift Serverless
OpenShift Service Mesh
Multicluster Engine for Kubernetes
Dell EMC Storage Monitoring and Reporting (SMR)
Red Hat Ceph Storage
IBM Qradar SIEM
Red Hat Single Sign-On

Install updates from vendor's website.

OpenSSH - update to 9.6p1
libssh - addressed in versions 0.9.8, 0.10.6
IBM MQ Operator - addressed in versions 2.0.23, 3.2.0
LANTIME Operating System Firmware (LTOS) - update to 7.08.007
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
libssh-gcrypt-4 (Ubuntu package) - update to Ubuntu Pro
libssh-4 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.9.3-2ubuntu2.5, 0.9.6-2ubuntu0.22.04.3, 0.10.4-2ubuntu0.3, 0.10.5-3ubuntu1.2
libssh-help - addressed in versions 0.9.4-9, 0.9.6-8
libssh-debuginfo - addressed in versions 0.9.4-9, 0.9.6-8
libssh-devel - addressed in versions 0.9.4-9, 0.9.6-8
libssh-debugsource - addressed in versions 0.9.4-9, 0.9.6-8
libssh - addressed in versions 0.9.4-9, 0.9.6-8
libssh - addressed in versions 0.9.6-12, 0.10.5-3
libssh-devel - addressed in versions 0.9.6-12, 0.10.5-3
libssh-config - addressed in versions 0.9.6-12, 0.10.5-3
libssh-doc - addressed in versions 0.9.6-12, 0.10.5-3
libssh (Red Hat package) - addressed in versions 0.9.6-14.el8, 0.10.4-13.el9
libssh (Debian package) - addressed in versions 0.9.8-0+deb11u1, 0.10.6-0+deb12u1
libssh4-32bit - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh-config - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh-debugsource - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh4 - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh4-debuginfo - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh-devel - addressed in versions 0.9.8-3.12.2, 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh4-debuginfo-32bit - update to 0.9.8-3.12.2
libssh4-32bit-debuginfo - addressed in versions 0.9.8-150200.13.3.1, 0.9.8-150400.3.3.1
libssh4-64bit-debuginfo - update to 0.9.8-150400.3.3.1
libssh4-64bit - update to 0.9.8-150400.3.3.1
libssh - update to 0.10.6
net-libs/libssh - update to 0.10.6
libssh - addressed in versions 0.10.6-1.fc38, 0.10.6-1.fc39, 0.10.6-2.fc38
Migration Toolkit for Runtimes - update to 1.2.6
Migration Toolkit for Containers - update to 1.8.4
Red Hat OpenShift GitOps - addressed in versions 1.10.6, 1.11.5, 1.12.3, 1.12.5, 1.13.1
Red Hat OpenShift Serverless - update to 1.33.0
Ansible Automation Platform - update to 2.4
OpenShift Service Mesh - addressed in versions 2.4.8, 2.5.2
Multicluster Engine for Kubernetes - update to 2.7.4
Red Hat Advanced Cluster Management for Kubernetes - update to 2.8.7
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
PowerStore X - update to 3.2.1.4-2386214
IBM Cloud Transformation Advisor - update to 3.10.0
PowerStore T - update to 4.0.0.2-2365061
Storage Resource Manager - update to 4.10.0.3
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.3
Red Hat OpenShift Container Platform - addressed in versions 4.12.58, 4.13.45, 4.14.32, 4.14.33, 4.16.15, 4.17.0
App Connect Enterprise Certified Container - addressed in versions 5.0.19, 12.2.0
watsonx Assistant Cartridge - update to 5.1.3
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
Red Hat Ceph Storage - update to 5.3
Dell Secure Connect Gateway - update to 5.24.00.14
IBM Qradar SIEM - update to 7.5.0 Update Pack 10 IF01
Red Hat Single Sign-On - update to 7.6.9
Storage Protect Plus Server - update to 10.1.16.3
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP3, 10.3.1060.0 SP1
Azure Stack - update to 10.2402
EMC Cloud Tiering Appliance - update to 13.2.0.2.29

• https://www.openssh.com/releasenotes.html#9.6p1

• Multiple vulnerabilities in OpenSSH
• Multiple vulnerabilities in libssh
• Fedora 39 update for libssh
• Fedora 38 update for libssh
• Slackware Linux update for libssh
• Fedora 38 update for libssh
• Gentoo update for libssh
• SUSE update for libssh
• Ubuntu update for libssh
• Ubuntu update for libssh
• SUSE update for libssh
• SUSE update for libssh
• openEuler 22.03 LTS update for libssh
• openEuler 22.03 LTS SP1 update for libssh
• openEuler 20.03 LTS SP1 update for libssh
• openEuler 22.03 LTS SP3 update for libssh
• openEuler 22.03 LTS SP2 update for libssh
• openEuler 20.03 LTS SP4 update for libssh
• Red Hat Enterprise Linux 9 update for libssh
• Red Hat Enterprise Linux 8 update for libssh
• Multiple vulnerabilities in Dell APEX Cloud Platform for Microsoft Azure and Dell APEX Cloud Platform Foundation Software
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Secure Connect Gateway
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Migration Toolkit for Runtimes 1.2
• Multiple vulnerabilities in OpenShift Service Mesh 2.5
• Multiple vulnerabilities in OpenShift Service Mesh 2.4
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.33
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in Red Hat Ceph Storage 5
• Debian update for libssh
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.8
• Multiple vulnerabilities in App Connect Enterprise Certified Container
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat Single Sign-On 7.6
• Multiple vulnerabilities in IBM Storage Protect Plus
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell PowerStore X
• Multiple vulnerabilities in IBM Power Hardware Management Console (HMC)
• Multiple vulnerabilities in Dell PowerStore T Family
• Anolis OS update for libssh
• Anolis OS update for libssh
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.7
• Multiple vulnerabilities in IBM webMethods Managed File Transfer
• IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge update for libssh
• Meinberg LANTIME firmware update for third-party components (January 2024)
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.10
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift distributed tracing (RHOSDT) 3.2