CVE-2023-51385

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
openbsdopenssh
𝑥
< 9.6
debiandebian_linux
10.0
debiandebian_linux
11.0
debiandebian_linux
12.0
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
SiemensSIMATIC S7-1500 CPU 1518-4 PN\/DP MFP
V3.1.5 ≤
𝑥
< *
ADP
SiemensSIMATIC S7-1500 CPU 1518-4 PN\/DP MFP
V3.1.5 ≤
𝑥
< *
ADP
SiemensSIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP
V3.1.5 ≤
𝑥
< *
ADP
SiemensSIMATIC S7-1500 CPU 1518F-4 PN\/DP MFP
V3.1.5 ≤
𝑥
< *
ADP
SiemensSIPLUS S7-1500 CPU 1518-4 PN\/DP MFP
V3.1.5 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
openssh
bookworm
1:9.2p1-2+deb12u3
fixed
bookworm (security)
1:9.2p1-2+deb12u3
fixed
bullseye
1:8.4p1-5+deb11u3
fixed
bullseye (security)
1:8.4p1-5+deb11u3
fixed
sid
1:9.9p1-3
fixed
trixie
1:9.9p1-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
openssh
bionic
Fixed 1:7.6p1-4ubuntu0.7+esm3
released
focal
Fixed 1:8.2p1-4ubuntu0.11
released
jammy
Fixed 1:8.9p1-3ubuntu0.6
released
lunar
Fixed 1:9.0p1-1ubuntu8.7
released
mantic
Fixed 1:9.3p1-1ubuntu3.2
released
noble
Fixed 1:9.6p1-3ubuntu1
released
oracular
Fixed 1:9.6p1-3ubuntu1
released
trusty
ignored
xenial
Fixed 1:7.2p2-4ubuntu2.10+esm6
released
openssh-ssh1
bionic
needed
focal
needed
jammy
needed
lunar
ignored
mantic
ignored
noble
needed
oracular
needed
trusty
dne
xenial
dne
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
openssh
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.4 AUS
0:8.0p1-7.el8_4.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
RHEL 9
0:8.7p1-34.el9_3.3
fixed
openssh-askpass
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
RHEL 9
0:8.7p1-34.el9_3.3
fixed
openssh-cavs
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
openssh-clients
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.4 AUS
0:8.0p1-7.el8_4.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
RHEL 9
0:8.7p1-34.el9_3.3
fixed
openssh-keycat
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
RHEL 9
0:8.7p1-34.el9_3.3
fixed
openssh-ldap
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
openssh-server
RHEL 8
0:8.0p1-19.el8_9.2
fixed
RHEL 8.4 AUS
0:8.0p1-7.el8_4.2
fixed
RHEL 8.6 AUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 E4S
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 EUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.6 TUS
0:8.0p1-15.el8_6.3
fixed
RHEL 8.8 AUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 E4S
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 EUS
0:8.0p1-19.el8_8.2
fixed
RHEL 8.8 TUS
0:8.0p1-19.el8_8.2
fixed
RHEL 9
0:8.7p1-34.el9_3.3
fixed
pam
RHEL 8
0:0.10.3-7.19.el8_9.2
fixed
RHEL 8.6 AUS
0:0.10.3-7.15.el8_6.3
fixed
RHEL 8.6 E4S
0:0.10.3-7.15.el8_6.3
fixed
RHEL 8.6 EUS
0:0.10.3-7.15.el8_6.3
fixed
RHEL 8.6 TUS
0:0.10.3-7.15.el8_6.3
fixed
RHEL 8.8 AUS
0:0.10.3-7.19.el8_8.2
fixed
RHEL 8.8 E4S
0:0.10.3-7.19.el8_8.2
fixed
RHEL 8.8 EUS
0:0.10.3-7.19.el8_8.2
fixed
RHEL 8.8 TUS
0:0.10.3-7.19.el8_8.2
fixed
RHEL 9
0:0.10.4-5.34.el9_3.3
fixed
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2024/Mar/21
http://www.openwall.com/lists/oss-security/2023/12/26/4
https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
https://security.gentoo.org/glsa/202312-17
https://security.netapp.com/advisory/ntap-20240105-0005/
https://support.apple.com/kb/HT214084
https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
https://www.debian.org/security/2023/dsa-5586
https://www.openssh.com/txt/release-9.6
https://www.openwall.com/lists/oss-security/2023/12/18/2
http://seclists.org/fulldisclosure/2024/Mar/21
http://www.openwall.com/lists/oss-security/2023/12/26/4
http://www.openwall.com/lists/oss-security/2025/10/07/1
http://www.openwall.com/lists/oss-security/2025/10/12/1
https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
https://security.gentoo.org/glsa/202312-17
https://security.netapp.com/advisory/ntap-20240105-0005/
https://support.apple.com/kb/HT214084
https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
https://www.debian.org/security/2023/dsa-5586
https://www.openssh.com/txt/release-9.6
https://www.openwall.com/lists/oss-security/2023/12/18/2
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-769027.html
https://cert-portal.siemens.com/productcert/html/ssa-794697.html