CVE-2019-3463 — rssh - security update

Description

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

How to fix CVE-2019-3463

To remediate CVE-2019-3463, upgrade the affected package to a fixed version below.

Alpine/rssh—upgrade to 2.3.4-r2 or later
—upgrade to 2.3.4-4+deb8u2 or later
—upgrade to 2.3.4-5+deb9u2 or later

Is CVE-2019-3463 being exploited?

Low — EPSS is 4.6%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

from 0, < 2.3.4-r2
from 0, < 2.3.4-4+deb8u2
from 0, < 2.3.4-5+deb9u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

ADVISORYsecurity.alpinelinux.org/vuln/CVE-2019-3463