CVE-2016-6902 lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
CriticalCVSS 9.9
EPSS 5.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi limited-shell(PyPI) | <= 0.9.16 | No fix listed |
| lshell project lshell | = 0.9.16 | No fix listed |
References
- 92591 third-party-advisory vdb-entry vendor-advisory
- [oss-security] 20160822 Re: CVE Request: lshell: shell outbreak vulnerabilities via bad syntax parse and multiline commands mailing-list patch third-party-advisory
- bugs.debian.org issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory