Rssh

rssh

Vendor: Pizzashack • 7 CVEs

CVEs (7)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-3464 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraRssh+1 more Jun 17, 2026 Feb 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution o...Show more Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.Show less
CVE-2019-3463 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraRssh+1 more Jun 17, 2026 Feb 6, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary...Show more Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.Show less
CVE-2019-1000018 4Canonical DebianFedoraproject+1 more 4Debian Linux FedoraRssh+1 more Jun 17, 2026 Feb 4, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appea...Show more rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.Show less
CVE-2012-2252 1Pizzashack 1Rssh Apr 29, 2026 Jan 11, 2013 N/A· v4 N/A· v3 4.4 MEDIUM· v2 Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.
CVE-2012-2251 1Pizzashack 1Rssh Apr 29, 2026 Jan 11, 2013 N/A· v4 N/A· v3 4.4 MEDIUM· v2 rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option.
CVE-2012-3478 1Pizzashack 1Rssh Apr 29, 2026 Aug 31, 2012 N/A· v4 N/A· v3 2.1 LOW· v2 rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.
CVE-2004-1628 1Pizzashack 1Rssh Apr 16, 2026 Oct 23, 2004 N/A· v4 N/A· v3 9.0 HIGH· v2 Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.