Validation of shell metacharacters in user names supplied on the command-line was performed too late to prevent some situations where they could be expanded from %-tokens in ssh_config. For certain configurations, such as those that use a "%u" token in a "Match exec" block, an attacker who can control the user name passed to ssh(1) could potentially execute arbitrary shell commands.
| Vendor | Product | Versions |
|---|---|---|
| OpenSSH | openssh | < 10.3 |
Updated description with more technical detail, added vendor OpenSSH, and marked exploit as available and actively exploited.
Initial creation
