CVE-2019-3464

Critical

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that…

debian·CWE-665·Published 2019-02-06

CVSS

9.8

EPSS

0.05

KEV

Exploits

Vendor statements (6)

cve.orgen

247 chars

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

NVDes

285 chars

El saneamiento insuficiente de las variables de entorno que se pasan a rsync puede omitir las restricciones impuestas por rssh, un shell restringido que debería hacer que los usuarios solo puedan realizar operaciones rsync, lo que resulta en la ejecución de comandos shell arbitrarios.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.5	10.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H