CVE-2019-1000018: canonical ubuntu_linux Command Injection

Modified

AliasesALPINE-CVE-2019-1000018UBUNTU-CVE-2019-1000018DLA-1650-1+1 more

Published 04-02-2019Last modified 19-03-2025

Vulnerability summary

CVE-2019-1000018 is a high (CVSS 7.8) Command Injection vulnerability in canonical ubuntu_linux. EPSS estimates a 1.88% chance of exploitation in the next 30 days, higher than 79.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

42/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

1.88%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

USN-3946-1

Timeline

04-02-2019
PublishedVulnerability first disclosed.
19-03-2025
Last modifiedVulnerability information updated.

Description

rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.

CVSS metrics

5 scores · 3 sources · 3 versions

v3.17.8v3.07.8v2.04.6

EPSS trend

Probability

1.88%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.88% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (esnet-security.github.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Affected systems

Debian2 products

rssh< 2.3.4-5+deb9u1 | < 2.3.4-4+deb8u1
debian_linuxEOL8.0 | 9.0

Alpine1 product

rssh< 2.3.4-r2

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10

Fedoraproject1 product

fedoraEOL29 | 30 | 31

Pizzashack1 product

rssh2.3.4

Ubuntu1 product

rssh< 2.3.4-4+deb8u2ubuntu0.14.04.2 | < 2.3.4-4+deb8u2ubuntu0.16.04.2 | < 2.3.4-7ubuntu0.1

6 vendors · 7 products

References

19 links

esnet-security.github.io/vulnerabilities/20190115_rsshExploitThird Party AdvisoryREPORT
www.debian.org/security/2019/dsa-4377Vendor AdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2019/01/msg00027.htmlMailing ListThird Party Advisory
usn.ubuntu.com/3946-1/Vendor AdvisoryThird Party Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
lists.fedoraproject.org/archives/…Vendor Advisory
security.gentoo.org/glsa/202007-29Vendor AdvisoryThird Party Advisory
seclists.org/fulldisclosure/2021/May/78Mailing ListNot ApplicableThird Party Advisory
github.com/WlX-33/…

Show all 19 references

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAX Transferred
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAX Transferred
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORAX Transferred
security.alpinelinux.org/vuln/CVE-2019-1000018Advisory
ubuntu.com/security/CVE-2019-1000018REPORT
sourceforge.net/p/rssh/mailman/message/36519118/REPORT
salsa.debian.org/debian/rssh/commit/3536b6d8e77ece7d66215fe1d08cf633d6b1c97bREPORT
ubuntu.com/security/notices/USN-3946-1Advisory
www.cve.org/CVERecord?id=CVE-2019-1000018REPORT