GHSA-3x7f-q7wf-fp73
UnknownSummary
Shell command injection is possible in Net::SSH::Proxy::Command and Net::SSH::Proxy::Jump. When an application configures a proxy and passes attacker-influenced host, port, or remote_user values to Net::SSH.start (or a jump string to Proxy::Jump.new), shell metacharacters in those values may be interpreted.
Risk Assessment
An attacker able to influence connection parameters may execute arbitrary shell commands on the application host, risking system compromise. The risk affects applications passing untrusted data into SSH proxy configuration.
Recommendation
Update the net-ssh library to a version containing the fix and avoid passing untrusted data into proxy parameters. Validate and sanitize host, port, and remote_user values before use.
Other vulnerabilities in net-ssh
See all- GHSA-vxj5-fg65-x765High
net-ssh's host-certificate verifier (`Net::SSH::HostKeyEntries::CertAuthority#matches_key?`) checks exactly two things when a server presents an OpenSSH certificate (`*[email protected]`) under a `@cert-authority` trusted-CA entry: (1) the cert is self-consistently signed (signature_valid).
- GHSA-qpg5-fx6p-8cq3High
In net-ssh, `Service::Forward#initialize` registers server-initiated auth-agent channel handlers unconditionally, so ordinary port forwarding exposes the local SSH agent.
- GHSA-pfqh-p9vh-wx4pUnknown
net-ssh's transport packet reader trusts the 4-byte wire packet length without capping it against RFC 4253 §6.1 (35000 bytes). Pre-KEX (plaintext), a malicious server can declare an arbitrarily large packet length and stream data, causing unbounded client memory growth before authentication.
- GHSA-r75w-7fhp-84w8Unknown
Net::SSH::Transport::ServerVersion#read! appends each received byte to @version until a newline, then copies to @header, with no maximum line length or total byte cap enforced. A malicious server sending a long identification line without LF causes unbounded memory growth.
- GHSA-rpq3-v334-f5pmUnknown
When a crafted ed25519 private key containing an insane number of rounds is loaded, net-ssh enters an infinite CPU-time consuming loop for a very long time trying to load the key. The fact that the key is not a real SSH key does not matter in this regard.
- GHSA-ggxh-cfwq-5xqcUnknown
Net::SSH::Transport::Session#poll_message pushes every packet received during key exchange that is not on the "allowed during KEX" list into an unbounded @queue (Array) with no size cap. A malicious server that completes KEXINIT (putting net-ssh into pending KEX) and then floods non-allowed packets can cause unbounded memory growth.
Original NVD description (English source)
## Summary Shell command injection is possible in Net::SSH::Proxy::Command and Net::SSH::Proxy::Jump. When an application configures a proxy and passes an attacker-influenced host, port, or remote_user to Net::SSH.start (or jump string to Proxy::Jump.new), shell metacharacters in those values are i
Vulnerability data from NVD (NIST) · CISA KEV · EPSS