CVE-2019-3464

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions...

9.8 CriticalFix available

CVE-2019-3464 is a critical vulnerability (CVSS 9.8) in Debian Gnu/linux Rssh, published February 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.70%, the 91st percentile. Fixed in rssh 2.3.4-r1.

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.70%Up 1.1 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

Record: CVE-2019-3464
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-665
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-3464
Updated: 2026-11-02

EUVDEUVD-2019-13103 No score

Record: EUVD-2019-13103
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wp4w-52jh-8g3x 9.8

Insufficient sanitization of environment variables passed to rsync can bypass the restrictions...

Record: GHSA-wp4w-52jh-8g3x
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-665
Updated: 2026-11-02

OSVALPINE-CVE-2019-3464 9.8

Record: ALPINE-CVE-2019-3464
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

Record: CVE-2019-3464
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-3464 9.8

Record: UBUNTU-CVE-2019-3464
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-3946-1 No score

rssh vulnerabilities

It was discovered that rssh incorrectly handled certain command-line arguments and environment variables. An authenticated user could bypass rssh's command restrictions, allowing an attacker to run arbitrary commands.

Record: USN-3946-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`rssh` Alpine:v3.13	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.14	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.15	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.16	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.17	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.18	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.19	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.20	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.21	before 2.3.4-r1	2.3.4-r1
`rssh` Alpine:v3.22	before 2.3.4-r1	2.3.4-r1

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`rssh` Debian:8	before 2.3.4-4+deb8u2, plus listed versions 2.3.4-42.3.4-4+deb8u1	2.3.4-4+deb8u2
`rssh` Debian:9	before 2.3.4-5+deb9u2, plus listed versions 2.3.4-52.3.4-5+deb9u1	2.3.4-5+deb9u2
`rssh` Ubuntu:14.04:LTS	before 2.3.4-4+deb8u2ubuntu0.14.04.2, plus listed versions 2.3.4-32.3.4-42.3.4-4+deb8u1build0.14.04.12.3.4-4+deb8u2build0.14.04.12.3.4-4+deb8u2ubuntu0.14.04.1	2.3.4-4+deb8u2ubuntu0.14.04.2
`rssh` Ubuntu:16.04:LTS	before 2.3.4-4+deb8u2ubuntu0.16.04.2, plus listed versions 2.3.4-42.3.4-4+deb8u1build0.16.04.12.3.4-4+deb8u2build0.16.04.12.3.4-4+deb8u2ubuntu0.16.04.1	2.3.4-4+deb8u2ubuntu0.16.04.2
`rssh` Ubuntu:18.04:LTS	before 2.3.4-7ubuntu0.1, plus listed versions 2.3.4-52.3.4-62.3.4-7	2.3.4-7ubuntu0.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 15 moreShow less