===========================================================
== Subject:     Security weakness in ProxyCommand handling
==
== CVE ID#:     CVE-2023-6004
==
== Versions:    0.10.x, 0.9.x, 0.8.x
==
== Summary:     ProxyCommand/ProxyJump features enable to inject
                malicious code through hostname
==
===========================================================

===========
Description
===========

Using the ProxyCommand or the ProxyJump feature enables users to exploit
unchecked hostname syntax on the client, which enables to inject malicious code
into the command of the above-mentioned features through the hostname parameter.

User interaction is required to exploit this issue.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.10, 0.9 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N (3.9)

==========
Workaround
==========

Sanitize hostname input

=======
Credits
=======

Originally reported by Vinci (https://github.com/vin01).
Patches provided by Norbert Pocs of the libssh team.

==========================================================
== The libssh team
==========================================================