Bug 2251110 (CVE-2023-6004)

Summary: CVE-2023-6004 libssh: ProxyCommand/ProxyJump features allow injection of malicious code through hostname
Product: [Other] Security Response Reporter: Anten Skrabec <askrabec>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jjelen, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libssh 0.9.8, libssh 0.10.6 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2255152    
Bug Blocks: 2251111    

Description Anten Skrabec 2023-11-22 23:23:13 UTC 
Using the ProxyCommand or the ProxyJump feature enables users to exploit
unchecked hostname syntax on the client, which enables to inject malicious code
into the command of the above-mentioned features through the hostname parameter.

User interaction is required to exploit this issue.
Comment 2 Anten Skrabec 2023-12-18 22:29:41 UTC 
Created libssh tracking bugs for this issue:

Affects: fedora-all [bug 2255152]
Comment 4 errata-xmlrpc 2024-04-30 11:01:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2504 https://access.redhat.com/errata/RHSA-2024:2504
Comment 5 errata-xmlrpc 2024-05-22 10:19:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3233 https://access.redhat.com/errata/RHSA-2024:3233