ISOMAN

CVE

CVE-2019-3464

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

Severity
CRITICAL
CVSS
9.8
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource

References

  1. http://seclists.org/fulldisclosure/2021/May/78
  2. http://www.securityfocus.com/bid/106839
  3. https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html
  4. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
  5. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
  6. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
  7. https://security.gentoo.org/glsa/202007-29
  8. https://tracker.debian.org/news/1026713/accepted-rssh-234-5deb9u2-source-amd64-into-stable-embargoed-stable/
  9. https://usn.ubuntu.com/3946-1/
  10. https://www.debian.org/security/2019/dsa-4382
  11. http://seclists.org/fulldisclosure/2021/May/78
  12. http://www.securityfocus.com/bid/106839
  13. https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html
  14. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/
  15. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/
  16. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/
  17. https://security.gentoo.org/glsa/202007-29
  18. https://tracker.debian.org/news/1026713/accepted-rssh-234-5deb9u2-source-amd64-into-stable-embargoed-stable/
  19. https://usn.ubuntu.com/3946-1/
  20. https://www.debian.org/security/2019/dsa-4382