Index: security/vuxml/vuln.xml =================================================================== --- security/vuxml/vuln.xml +++ security/vuxml/vuln.xml @@ -58,6 +58,35 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + rssh - multiple vulnerabilities + + + rssh + 2.3.4_2 + + + + +

NVD reports:

+
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
+
Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.
+

+ + + + https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4 + CVE-2019-1000018 + CVE-2019-3463 + CVE-2019-3464 + + + 2019-02-04 + 2019-03-06 + + + slixmpp -- improper access control