pizzashack rssh vulnerabilities

Latest pizzashack rssh CVEs

Newest publication first

1. CVE-2019-3464 Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resultin...

   Published 2019-02-06

   Critical·CVSS 9.8 EPSS 4.7%

   Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

2. CVE-2019-3463 Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the exe...

   Published 2019-02-06

   Critical·CVSS 9.8 EPSS 4.9%

   Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

3. CVE-2019-1000018 rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command executio...

   Published 2019-02-04

   High·CVSS 7.8 EPSS 1.9%

   rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allo...

4. CVE-2012-2252 Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.

   Published 2013-01-11

   Medium·CVSS 4.4 EPSS 0.37%

   Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option.

5. CVE-2012-2251 rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option.

   Published 2013-01-11

   Medium·CVSS 4.4 EPSS 0.34%

   rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option.

6. CVE-2012-3478 rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.

   Published 2012-08-31

   Low·CVSS 2.1 EPSS 0.39%

   rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.

7. CVE-2004-1628 Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.

   Published 2005-02-20

   High·CVSS 9.0 EPSS 4.7%

   Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.