LOW 3.5 Go
sshproxy vulnerable to SSH option injection
GHSA-jmqp-37m5-49wh · CVE-2024-34713 · GO-2024-2836
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy.
All versions of sshproxy are impacted.
Patches
The problem is patched starting on version 1.6.3
Workarounds
The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
References
References
- WEB https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-34713
- WEB https://github.com/cea-hpc/sshproxy/commit/3b8bccc874dc4ca2c80c956cad65722abb46f0b9
- WEB https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580
- PACKAGE https://github.com/cea-hpc/sshproxy
Ready to move
Start Securing
Free, no credit card | First findings in minutes