UBUNTU-CVE-2023-51385

Advisory lineage Upstream: 1 Downstream: 3
Upstream
CVE-2023-51385
Published: 20 Dec 2023, 00:00
Last modified:20 May 2026, 16:13

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

20 Dec 2023, 00:00
Published
Vulnerability first disclosed
20 May 2026, 16:13
Last Modified
Vulnerability information updated

Description

In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Systems

  • ubuntu•openssh

    all | < 1:7.2p2-4ubuntu2.10+esm6 | < 1:7.2p2-4ubuntu2.fips.2.10.6 | < 1:7.6p1-4ubuntu0.7+esm3 | < 1:7.9p1-10~ubuntu18.04.fips.0.9 | < 1:8.2p1-4ubuntu0.11 | < 1:8.2p1-4ubuntu0.fips.0.11 | < 1:8.9p1-3ubuntu0.6 | < 1:9.6p1-3ubuntu1

  • ubuntu•openssh-ssh1

    all | all | all | all | all | all

References (7)