Date: Wed, 6 Mar 2019 19:56:57 +0000 (UTC) From: Kai Knoblich <kai@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r494835 - head/security/vuxml Message-ID: <201903061956.x26JuvuB057106@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: kai Date: Wed Mar 6 19:56:57 2019 New Revision: 494835 URL: https://svnweb.freebsd.org/changeset/ports/494835 Log: security/vuxml: Document shells/rssh < 2.3.4_2 vulnerabilities PR: 235121 Approved by: tcberner (mentor) Differential Revision: https://reviews.freebsd.org/D19473 Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Mar 6 19:49:56 2019 (r494834) +++ head/security/vuxml/vuln.xml Wed Mar 6 19:56:57 2019 (r494835) @@ -58,6 +58,35 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="d193aa9f-3f8c-11e9-9a24-6805ca0b38e8"> + <topic>rssh - multiple vulnerabilities</topic> + <affects> + <package> + <name>rssh</name> + <range><lt>2.3.4_2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>NVD reports:</p> + <blockquote cite="https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4">; + <p>rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.</p> + <p>Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.</p> + </blockquote> + </body> + </description> + <references> + <url>https://nvd.nist.gov/vuln/search/results?form_type=Advanced&cves=on&cpe_version=cpe%3a%2fa%3apizzashack%3arssh%3a2.3.4</url>; + <cvename>CVE-2019-1000018</cvename> + <cvename>CVE-2019-3463</cvename> + <cvename>CVE-2019-3464</cvename> + </references> + <dates> + <discovery>2019-02-04</discovery> + <entry>2019-03-06</entry> + </dates> + </vuln> + <vuln vid="416ca0f4-3fe0-11e9-bbdd-6805ca0b3d42"> <topic>rt -- XSS via jQuery</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201903061956.x26JuvuB057106>