Command Injection

🗓️ 21 Dec 2023 09:16:27Reported by Veracode Vulnerability DatabaseType

Vulnerability in libssh.so due to insufficient validation of hostname parameter, allowing Command Injection via ProxyCommand or ProxyJump features

Reporter	Title	Published	Views	Family All 157
IBM Security Bulletins	Security Bulletin: Vulnerabilities in libssh (CVE-2023-6004, CVE-2023-6918) affect Power HMC.	14 Dec 202412:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to libssh, Linux-pam ,Kerberos 5, systemd and idna packages/liberaries.	17 Jun 202411:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM webMethods Managed File Transfer	25 Apr 202510:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in libssh affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	14 May 202519:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container UBI updates	23 Aug 202409:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Injection in the RHEL UBI (CVE-2023-6004)	27 Jun 202519:44	–	ibm
Tenable Nessus	Alibaba Cloud Linux 3 : 0119: libssh (ALINUX3-SA-2024:0119)	14 May 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: libssh (CVE-2023-6004)	22 Jan 202600:00	–	nessus
Tenable Nessus	CentOS 8 : libssh (CESA-2024:3233)	22 May 202400:00	–	nessus

Vulners

Node

libssh libsshMatch0.10.5-r0cpp

AND

libssh libsshMatch0.9.5-r0cpp

AND

libssh libsshMatch0.9.6-r1cpp

AND

libssh libsshMatch0.10.5-r0cpp

AND

libssh libsshMatch0.9.6-r2cpp

AND

libssh libsshMatch0.10.0-r1cpp

AND

libssh libsshMatch0.9.4-r0cpp

AND

libssh libsshMatch0.10.3-r0cpp

AND

libssh libsshMatch0.9.3-r1cpp

AND

libssh libsshMatch0.10.4-r0cpp

AND

libssh libsshMatch0.9.6-r0cpp

AND

libssh.so libssh.soRange4.9.0–4.9.5cpp

libssh.so libssh.soRangedebug–4.8.7cpp

Source	Link
libssh	www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/
git	www.git.libssh.org/projects/libssh.git/commit/
libssh	www.libssh.org/security/advisories/CVE-2023-6004.txt
access	www.access.redhat.com/security/cve/CVE-2023-6004
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/LZQVUHWVWRH73YBXUQJOD6CKHDQBU3DM/
security	www.security.netapp.com/advisory/ntap-20240223-0004/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/errata/RHSA-2024:2504
access	www.access.redhat.com/errata/RHSA-2024:3233

22 May 2024 18:45Current

7High risk

Vulners AI Score7

CVSS 3.14.8

EPSS0.00051