CyberSec.Space Logo
Back to CVE Browser

CVE-2019-3463

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile13.10th
PublishedFeb 6, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

Affected Platforms (CPE)

📦
Pizzashack

Rssh

= 2.3.4
💻
Debian

Debian Linux

= 8.0
💻
Debian

Debian Linux

= 9.0
💻
Fedoraproject

Fedora

= 29
💻
Fedoraproject

Fedora

= 30
💻
Fedoraproject

Fedora

= 31
💻
Canonical

Ubuntu Linux

= 14.04
💻
Canonical

Ubuntu Linux

= 16.04
💻
Canonical

Ubuntu Linux

= 18.04
💻
Canonical

Ubuntu Linux

= 18.10

References & Advisories

🔗 http://seclists.org/fulldisclosure/2021/May/78
🔗 http://www.securityfocus.com/bid/106839
🔗 https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
🔗 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
🔗 https://security.gentoo.org/glsa/202007-29
🔗 https://tracker.debian.org/news/1026713/accepted-rssh-234-5deb9u2-source-amd64-into-stable-embargoed-stable/

Related Vulnerabilities

CVE-2019-34649.8

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell...

CVE-2004-16289.0

Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.

CVE-2019-10000187.8

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerab...

CVE-2004-11617.5

rssh 2.2.2 and earlier does not properly restrict programs that can be run, which could allow remote authenticated users to bypass...