Bug 2006958 (CVE-2020-26301)

Summary:	CVE-2020-26301 nodejs-ssh2: Command injection by calling vulnerable method with untrusted input
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, etamir, hvyas, nbecker, ocs-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	nodejs-ssh2 1.4.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in nodejs-ssh2. An OS command injection attack on Windows allows an attacker to perform remote code execution and potentially execute arbitrary code. The highest threat from this vulnerability is to confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-29 13:39:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2015207, 2015208, 2015209, 2015691, 2015762
Bug Blocks:	2006960

Description Pedro Sampaio 2021-09-22 17:56:00 UTC

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.

References:

https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
https://github.com/mscdex/ssh2/commit/f763271f41320e71d5cbee02ea5bc6a2ded3ca21
https://www.npmjs.com/package/ssh2

Comment 3 errata-xmlrpc 2021-11-29 13:24:47 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Storage 4.8.0 on RHEL-8

Via RHSA-2021:4845 https://access.redhat.com/errata/RHSA-2021:4845

Comment 4 Product Security DevOps Team 2021-11-29 13:39:00 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-26301