Vulnerability · Published Dec 18, 2023 · Assigned by mitre
CVE-2023-51385
Medium 6.5
In plain English
A medium-severity OS command injection in the openssh package (AlmaLinux). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 19.8% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | openssh | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:9 | openssh | 8.7p1-34.el9_3.3 | ALSA-2024:1130 |
| AlmaLinux:8 | openssh-askpass | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:9 | openssh-askpass | 8.7p1-34.el9_3.3 | ALSA-2024:1130 |
| AlmaLinux:8 | openssh-cavs | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:8 | openssh-clients | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:9 | openssh-clients | 8.7p1-34.el9_3.3 | ALSA-2024:1130 |
| AlmaLinux:8 | openssh-keycat | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:9 | openssh-keycat | 8.7p1-34.el9_3.3 | ALSA-2024:1130 |
| AlmaLinux:8 | openssh-ldap | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:8 | openssh-server | 8.0p1-19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:9 | openssh-server | 8.7p1-34.el9_3.3 | ALSA-2024:1130 |
| AlmaLinux:8 | pam_ssh_agent_auth | 0.10.3-7.19.el8_9.2 | ALSA-2024:0606 |
| AlmaLinux:9 | pam_ssh_agent_auth | 0.10.4-5.34.el9_3.3 | ALSA-2024:1130 |
| Alpine:v3.20 | openssh | 9.6_p1-r0 | ALPINE-CVE-2023-51385 |
| Alpine:v3.21 | openssh | 9.6_p1-r0 | ALPINE-CVE-2023-51385 |
| Alpine:v3.22 | openssh | 9.6_p1-r0 | ALPINE-CVE-2023-51385 |
| Alpine:v3.23 | openssh | 9.6_p1-r0 | ALPINE-CVE-2023-51385 |
| Alpine:v3.24 | openssh | 9.6_p1-r0 | ALPINE-CVE-2023-51385 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u2 | DSA-5586-1 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u2 | DEBIAN-CVE-2023-51385 |
| Debian:13 | openssh | 1:9.6p1-1 | DEBIAN-CVE-2023-51385 |
| Debian:14 | openssh | 1:9.6p1-1 | DEBIAN-CVE-2023-51385 |
| Rocky Linux:8 | openssh | 0:8.0p1-19.el8_9.2 | RLSA-2024:0606 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.6 | USN-6565-1 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.6 | UBUNTU-CVE-2023-51385 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu1 | UBUNTU-CVE-2023-51385 |
| Ubuntu:22.04:LTS | openssh-ssh1 | no fix listed | UBUNTU-CVE-2023-51385 |
| Ubuntu:24.04:LTS | openssh-ssh1 | no fix listed | UBUNTU-CVE-2023-51385 |
| Ubuntu:25.10 | openssh-ssh1 | no fix listed | UBUNTU-CVE-2023-51385 |
| Ubuntu:26.04:LTS | openssh-ssh1 | no fix listed | UBUNTU-CVE-2023-51385 |
| Ubuntu:26.10 | openssh-ssh1 | no fix listed | UBUNTU-CVE-2023-51385 |
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://www.openssh.com/txt/release-9.6
- https://www.openwall.com/lists/oss-security/2023/12/18/2
- https://github.com/openssh/openssh-portable/commit/7ef3787c84b6b524501211b11a26c742f829af1a
- DSA-5586 vendor-advisory
- https://vin01.github.io/piptagole/ssh/security/openssh/libssh/remote-code-execution/2023/12/20/openssh-proxycommand-libssh-rce.html
- [debian-lts-announce] 20231226 [SECURITY] [DLA 3694-1] openssh security update mailing-list
- [oss-security] 20231226 CVE-2023-51385, CVE-2023-6004: OpenSSH, libssh: Security weakness in ProxyCommand handling mailing-list
- GLSA-202312-17 vendor-advisory
- https://security.netapp.com/advisory/ntap-20240105-0005/
- https://support.apple.com/kb/HT214084
- 20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4 mailing-list
- http://www.openwall.com/lists/oss-security/2025/10/07/1
- http://www.openwall.com/lists/oss-security/2025/10/12/1
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
- https://cert-portal.siemens.com/productcert/html/ssa-769027.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html