CVE-2008-3234

sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.

Affected products

Debian, Openssh

Openbsd Openssh

= 4.0

Fix

Available

CVSS 2.0

6.5 MEDIUM

EPSS

5.8% (93th percentile)

Weakness

CWE-264

NVD status

Modified

Published

2008-07-18