CVE-2014-2532
Fixed in a distro release EPSS 5%CVSS 4.2
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
Products: oracle communications_user_data_repository, openbsd openssh
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openssh | 1:6.6p1-1 |
| Debian 13 | openssh | 1:6.6p1-1 |
| Debian 14 | openssh | 1:6.6p1-1 |
| Debian 6.0 | openssh | 1:5.5p1-6+squeeze5 |
| Debian 7 | openssh | 1:6.0p1-4+deb7u1 |
| Red Hat Enterprise Linux 6 | openssh | 0:5.3p1-104.el6 |
| Red Hat Enterprise Linux 6 | openssh-askpass | 0:5.3p1-104.el6 |
| Red Hat Enterprise Linux 6 | openssh-clients | 0:5.3p1-104.el6 |
| Red Hat Enterprise Linux 6 | openssh-debuginfo | 0:5.3p1-104.el6 |
| Red Hat Enterprise Linux 6 | openssh-ldap | 0:5.3p1-104.el6 |
| Red Hat Enterprise Linux 6 | openssh-server | 0:5.3p1-104.el6 |
| Red Hat Enterprise Linux 6 | pam_ssh_agent_auth | 0:0.9.3-104.el6 |