CVE-2024-34713

{"id": "CVE-2024-34713", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}]}, "published": "2024-05-14T16:17:27.147", "references": [{"url": "https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580", "source": "security-advisories@github.com"}, {"url": "https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh", "source": "security-advisories@github.com"}, {"url": "https://github.com/cea-hpc/sshproxy/commit/f7eabd05d5f0f951e160293692327cad9a7d9580", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant."}, {"lang": "es", "value": "sshproxy se utiliza en una puerta de enlace para representar de forma transparente una conexi\u00f3n SSH de usuario en la puerta de enlace a un host interno a trav\u00e9s de SSH. Antes de la versi\u00f3n 1.6.3, cualquier usuario autorizado para conectarse a un servidor ssh usando `sshproxy` pod\u00eda inyectar opciones al comando `ssh` ejecutado por `sshproxy`. Todas las versiones de `sshproxy` se ven afectadas. El problema se solucion\u00f3 a partir de la versi\u00f3n 1.6.3. La \u00fanica soluci\u00f3n es utilizar la opci\u00f3n `force_command` en `sshproxy.yaml`, pero rara vez es relevante."}], "lastModified": "2024-11-21T09:19:14.963", "sourceIdentifier": "security-advisories@github.com"}