4.8
Medium
CVE-2023-6004 Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname
Description
A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:LExploitable with local access to the machine, with an ordinary account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published |
Other CVEs of Red Hat Enterprise Linux 8
The 1839 CVEs of Red Hat Enterprise Linux 8 →
CVE-2026-123876
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
4.4
Medium
CVE-2026-120749
Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
6.2
Medium
CVE-2026-123151
Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail
Not rated
CVE-2026-121997
Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch
8.1
High