CVE-2019-3464

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

Link	Resource
https://tracker.debian.org/news/1026713/accepted-rssh-234-5deb9u2-source-amd64-into-stable-embargoed-stable/	Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4382	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/106839	Third Party Advisory VDB Entry
https://usn.ubuntu.com/3946-1/	Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN/	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202007-29	Third Party Advisory
http://seclists.org/fulldisclosure/2021/May/78	Mailing List Not Applicable

Configuration 1

cpe:2.3:a:pizzashack:rssh:2.3.4:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

---

Published : 2019-02-06 07:29

Updated : 2021-07-21 11:39

---

NVD link : CVE-2019-3464

Mitre link : CVE-2019-3464

No products.

CWE-665