CVE-2014-2532: openbsd openssh
CVSS: 5.8v2.0MediumModified
AliasesMGASA-2014-0143DEBIAN-CVE-2014-2532
Published 18-03-2014Last modified 28-05-2026
Vulnerability summary
CVE-2014-2532 is a medium (CVSS 5.8) vulnerability in openbsd openssh. EPSS estimates a 4.75% chance of exploitation in the next 30 days, higher than 91.7% of scored vulnerabilities.
CVSS score
5.8/10
010
Medium · v2.0 (NVD)EPSS score
4.75%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 18-03-2014PublishedVulnerability first disclosed.
- 28-05-2026Last modifiedVulnerability information updated.
Description
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
CVSS metrics
5 scores · 3 sources · 3 versionsMedium 4.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NSourcesAll 2 agree
- NVDNIST4.2MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Medium 4.9Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NSourcesAll 2 agree
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
4.75%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.75% on 18-09-2026
18-09-202618-10-2026
EPSS score4.75%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
Affected systems
Mageia2 products
- openssh< 6.1p1-4.2.mga3
- openssh< 6.2p2-3.1.mga4
Debian1 product
- openssh< 1:6.6p1-1
Openbsd1 product
- openssh≤ 6.5 | 6.0 | 6.1 | 6.2 | 6.3 | 6.4
Oracle1 product
4 vendors · 5 products
References
27 links- www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlX Refsource CONFIRM
- advisories.mageia.org/MGASA-2014-0143.htmlX Refsource CONFIRM
- www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlX Refsource CONFIRM
Show all 27 references
- support.apple.com/HT205267X Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.htmlVendor AdvisoryX Refsource FEDORA
- aix.software.ibm.com/aix/efixes/security/openssh_advisory4.ascX Refsource CONFIRM
- www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlX Refsource CONFIRM
- lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.htmlVendor AdvisoryX Refsource FEDORA