CVE-2014-2532

Publication date 18 March 2014

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssh	13.10 saucy	Fixed 1:6.2p2-6ubuntu0.2
	12.10 quantal	Fixed 1:6.0p1-3ubuntu1.1
	12.04 LTS precise	Fixed 1:5.9p1-5ubuntu1.2
	10.04 LTS lucid	Fixed 1:5.3p1-3ubuntu7.1

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssh	Upstream: http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.270;r2=1.271

Severity score breakdown

Parameter	Value
Base score	4.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Changed
Confidentiality	Low
Integrity impact	Low
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

References

Related Ubuntu Security Notices (USN)

USN-2155-1
OpenSSH vulnerability
25 March 2014