CVE-2023-6004
Description
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
Statement
Despite the potential severity of this issue, the requirement for user interaction to exploit the vulnerability has led to a low severity rating. As a precautionary measure, users are advised to sanitize hostname inputs as a mitigation strategy.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | 4.8 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | Low | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | Low | Low | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Red Hat CVSS v3 Score Explanation
The vulnerability can be exploited locally, requiring physical access or direct interaction with the system. The low attack complexity implies that it is relatively easy to exploit, but the impact is constrained by low privileges required and the need for user interaction. The low impact on confidentiality, integrity, and availability signifies that the vulnerability is not likely to result in significant data exposure, manipulation, or disruption of system services.
Despite the potential severity of this issue, the requirement for user interaction to exploit the vulnerability has led to a low severity rating. As a precautionary measure, users are advised to sanitize hostname inputs as a mitigation strategy.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Many injection attacks involve the disclosure of important information -- in terms of both data sensitivity and usefulness in further exploitation.
Access Control
Technical Impact: Bypass Protection Mechanism
In some cases, injectable code controls authentication; this may lead to a remote vulnerability.
Other
Technical Impact: Alter Execution Logic
Injection attacks are characterized by the ability to significantly change the flow of a given process, and in some cases, to the execution of arbitrary code.
Integrity,Other
Technical Impact: Other
Data injection attacks lead to loss of data integrity in nearly all cases as the control-plane data injected is always incidental to data recall or writing.
Non-Repudiation
Technical Impact: Hide Activities
Often the actions performed by injected control code are unlogged.
Acknowledgements
Red Hat would like to thank Norbert Pocs (libssh) and vinci@protonmail.ch for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
