In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-keycatUpgrade opensshUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-clientsUpgrade pam_ssh_agent_auth | Feb 1, 2024 | Dec 18, 2023 |
| Alpine Linux | — | Upgrade openssh | Mar 26, 2024 | Dec 18, 2023 |
| Amazon Linux Ami 2 | — | Upgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-keycatUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-debuginfoUpgrade openssh-cavs | Apr 2, 2024 | Dec 18, 2023 |
| Amazon_linux_2023 | — | Upgrade openssh-keycatUpgrade openssh-debuginfoUpgrade openssh-debugsourceUpgrade openssh-clientsUpgrade pam_ssh_agent_auth-debuginfoUpgrade opensshUpgrade openssh-clients-debuginfoUpgrade pam_ssh_agent_authUpgrade openssh-keycat-debuginfoUpgrade openssh-serverUpgrade openssh-server-debuginfo | Feb 17, 2025 | Dec 18, 2023 |
| Apple Osx Openssh | — | Upgrade macOS to the latest version | Jun 25, 2026 | Mar 7, 2024 |
| Aruba Aos 10 | — | Upgrade HPE Aruba Networking AOS-10 AP and AOS-8 InstantOS to one of the following software versions (as applicable) to resolve this vulnerability:
- AOS-10 AP 10.8.x.x: 10.8.0.0 and above
- AOS-8 Instant 8.13.x.x: 8.13.0.0 and above | Jan 14, 2025 | Aug 6, 2024 |
| Aruba Aos Cx | — | Upgrade affected switches to one of the following AOS-CX branches and versions to resolve all the vulnerabilities described in the details section:
- AOS-CX 10.13.xxxx: 10.13.1010 and above.
- AOS-CX 10.12.xxxx: 10.12.1030 and above.
- AOS-CX 10.10.xxxx: 10.10.1110 and above.
HPE Aruba Networking does not evaluate or patch product versions that have reached their End of Maintenance (EoM) milestone. For more
information about HPE Aruba's End of Support policy visit:
https://www.arubanetworks.com/support-services/end-of-life/
Supported branches as of the publication date of this advisory are:
- AOS-CX 10.13.xxxx
- AOS-CX 10.12.xxxx
- AOS-CX 10.10.xxxx
Software versions with resolution/fixes for the vulnerabilities covered above, can be downloaded from the HPE Networking Support Portal. | Feb 24, 2025 | Mar 5, 2024 |
| Aruba Ecos | — | HPE Aruba Networking advises customers to upgrade to the following
versions to address all vulnerabilities within this advisory, unless
otherwise specified in the Details section. These builds and branches
will fix the lower severity authenticated vulnerabilities that require
existing administrative access:
- ECOS 9.5.x: ECOS 9.5.0.0 (all builds) and above
- ECOS 9.4.x: ECOS 9.4.2.0 (all builds) and above
- ECOS 9.3.x: ECOS 9.3.4.0 (all builds) and above
The EdgeConnect SD-WAN Orchestrator software version must be greater
than or equal to the ECOS software version running on any EdgeConnect
SD-WAN gateways.
HPE Aruba Networking does not evaluate or patch software versions that
have reached their End of Maintenance (EoM) milestone.
Maintained versions as of the publication date of this advisory
are:
- HPE Aruba Networking EdgeConnect SD-WAN 9.5.x.x
- HPE Aruba Networking EdgeConnect SD-WAN 9.4.x.x
- HPE Aruba Networking EdgeConnect SD-WAN 9.3.x.x
- HPE Aruba Networking EdgeConnect SD-WAN 9.2.x.x
For more information about HPE Aruba Networking's End of Support policy
visit:
https://www.arubanetworks.com/support-services/end-of-life/ | Mar 17, 2025 | Jul 23, 2024 |
| Debian | — | Upgrade openssh | Dec 27, 2023 | Dec 18, 2023 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| F5 Big Ip | — | — | Mar 7, 2024 | Dec 18, 2023 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Dec 28, 2023 | Dec 18, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssh-serverUpgrade openssh-clientsUpgrade openssh | Mar 13, 2024 | Dec 18, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade openssh-clientsUpgrade opensshUpgrade openssh-server | Mar 13, 2024 | Dec 18, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade openssh-keycatUpgrade openssh-ldapUpgrade openssh-serverUpgrade openssh-clientsUpgrade opensshUpgrade openssh-askpassUpgrade openssh-cavs | Mar 13, 2024 | Dec 18, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssh-serverUpgrade opensshUpgrade openssh-clients | Feb 12, 2024 | Dec 18, 2023 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory16 | Feb 29, 2024 | Dec 18, 2023 |
| Openbsd Openssh | — | Upgrade to OpenSSH version 9.6 | Dec 27, 2023 | Dec 18, 2023 |
| Oracle_linux | — | Upgrade openssh-keycatUpgrade openssh-ldapUpgrade pam_ssh_agent_authUpgrade opensshUpgrade openssh-serverUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-cavs | Feb 1, 2024 | Dec 18, 2023 |
| Redhat_linux | — | Upgrade openssh-clients-debuginfoUpgrade openssh-keycat-debuginfoUpgrade openssh-askpassUpgrade openssh-cavsUpgrade openssh-server-debuginfoUpgrade opensshUpgrade openssh-keycatUpgrade openssh-serverUpgrade pam_ssh_agent_auth-debuginfoUpgrade openssh-debuginfoUpgrade openssh-ldap-debuginfoUpgrade openssh-debugsourceNo solution existsUpgrade openssh-cavs-debuginfoUpgrade openssh-askpass-debuginfoUpgrade openssh-sk-dummy-debuginfoUpgrade openssh-clientsUpgrade openssh-ldapUpgrade pam_ssh_agent_auth | Jan 26, 2024 | Dec 18, 2023 |
| Rocky_linux | — | — | Aug 15, 2024 | Dec 18, 2023 |
| Suse | — | Upgrade openssh-serverUpgrade openssh-helpersUpgrade opensshUpgrade openssh-fipsUpgrade openssh-commonUpgrade openssh-askpass-gnomeUpgrade openssh-clientsUpgrade openssh-testuserUpgrade openssh-cavsUpgrade openssh-server-config-disallow-rootlogin | Feb 23, 2024 | Dec 18, 2023 |
| Ubuntu | — | Upgrade openssh-clientUpgrade openssh-serverUpgrade openssh-client (Ubuntu Pro)Upgrade openssh-server (Ubuntu Pro) | Jan 4, 2024 | Dec 18, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 18, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub