CVE-2023-51385

Name
CVE-2023-51385
Description
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
cve@mitre.org https://www.openssh.com/txt/release-9.6
cve@mitre.org https://www.openwall.com/lists/oss-security/2023/12/18/2
cve@mitre.org https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
cve@mitre.org https://www.debian.org/security/2023/dsa-5586
cve@mitre.org https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
cve@mitre.org https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html
cve@mitre.org http://www.openwall.com/lists/oss-security/2023/12/26/4
cve@mitre.org https://security.gentoo.org/glsa/202312-17
cve@mitre.org https://security.netapp.com/advisory/ntap-20240105-0005/
cve@mitre.org https://support.apple.com/kb/HT214084
cve@mitre.org http://seclists.org/fulldisclosure/2024/Mar/21
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2025/10/07/1
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2025/10/12/1
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e https://cert-portal.siemens.com/productcert/html/ssa-082556.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e https://cert-portal.siemens.com/productcert/html/ssa-769027.html
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e https://cert-portal.siemens.com/productcert/html/ssa-794697.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* openssh >= None < 9.6

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openssh edge-main 9.6_p1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh edge-main 8.9_p2-r0 None possibly vulnerable
openssh edge-main 8.8_p1-r0 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh edge-main 8.5_p1-r0 None possibly vulnerable
openssh edge-main 8.4_p1-r0 None possibly vulnerable
openssh edge-main 7.9_p1-r3 None possibly vulnerable
openssh edge-main 7.7_p1-r4 None possibly vulnerable
openssh edge-main 7.5_p1-r8 None possibly vulnerable
openssh edge-main 7.4_p1-r0 None possibly vulnerable
openssh 3.22-main 9.6_p1-r0 None fixed
openssh 3.22-main 8.8_p1-r0 None possibly vulnerable
openssh 3.22-main 8.5_p1-r0 None possibly vulnerable
openssh 3.22-main 8.4_p1-r0 None possibly vulnerable
openssh 3.22-main 7.9_p1-r3 None possibly vulnerable
openssh 3.22-main 7.7_p1-r4 None possibly vulnerable
openssh 3.22-main 7.5_p1-r8 None possibly vulnerable
openssh 3.22-main 7.4_p1-r0 None possibly vulnerable
openssh 3.21-main 9.6_p1-r0 None fixed
openssh 3.21-main 8.8_p1-r0 None possibly vulnerable
openssh 3.21-main 8.5_p1-r0 None possibly vulnerable
openssh 3.21-main 8.4_p1-r0 None possibly vulnerable
openssh 3.21-main 7.9_p1-r3 None possibly vulnerable
openssh 3.21-main 7.7_p1-r4 None possibly vulnerable
openssh 3.21-main 7.5_p1-r8 None possibly vulnerable
openssh 3.21-main 7.4_p1-r0 None possibly vulnerable
openssh 3.20-main 9.6_p1-r0 None fixed
openssh 3.20-main 8.8_p1-r0 None possibly vulnerable
openssh 3.20-main 8.5_p1-r0 None possibly vulnerable
openssh 3.20-main 8.4_p1-r0 None possibly vulnerable
openssh 3.20-main 7.9_p1-r3 None possibly vulnerable
openssh 3.20-main 7.7_p1-r4 None possibly vulnerable
openssh 3.20-main 7.5_p1-r8 None possibly vulnerable
openssh 3.20-main 7.4_p1-r0 None possibly vulnerable
openssh 3.19-main 9.6_p1-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh 3.19-main 8.8_p1-r0 None possibly vulnerable
openssh 3.19-main 8.5_p1-r0 None possibly vulnerable
openssh 3.19-main 8.4_p1-r0 None possibly vulnerable
openssh 3.19-main 7.9_p1-r3 None possibly vulnerable
openssh 3.19-main 7.7_p1-r4 None possibly vulnerable
openssh 3.19-main 7.5_p1-r8 None possibly vulnerable
openssh 3.19-main 7.4_p1-r0 None possibly vulnerable
openssh 3.18-main 9.3_p2-r2 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.18-main 9.3_p2-r1 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable
openssh 3.17-main 9.1_p1-r6 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh 3.17-main 9.1_p1-r5 Natanael Copa <ncopa@alpinelinux.org> fixed
openssh 3.17-main 9.1_p1-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable