CVE-2024-34713
sshproxy vulnerable to SSH option injection
sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
sshproxy vulnerable to SSH option injection
sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
- Record
CVE-2024-34713- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2024-1670
sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
- Record
EUVD-2024-1670- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jmqp-37m5-49wh
sshproxy vulnerable to SSH option injection
Impact
Any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy.
All versions of sshproxy are impacted.
Patches
The problem is patched starting on version 1.6.3
Workarounds
The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
References
- Record
GHSA-jmqp-37m5-49wh- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
NVD
sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
- Record
CVE-2024-34713- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
sshproxy vulnerable to SSH option injection
sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy. All versions of sshproxy are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
- Record
CVE-2024-34713- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-jmqp-37m5-49wh
sshproxy vulnerable to SSH option injection
Impact
Any user authorized to connect to a ssh server using sshproxy can inject options to the ssh command executed by sshproxy.
All versions of sshproxy are impacted.
Patches
The problem is patched starting on version 1.6.3
Workarounds
The only workaround is to use the force_command option in sshproxy.yaml, but it's rarely relevant.
References
- Record
GHSA-jmqp-37m5-49wh- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGO-2024-2836 No score
sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy
sshproxy vulnerable to SSH option injection in github.com/cea-hpc/sshproxy
- Record
GO-2024-2836- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/cea-hpc/sshproxyGo |
through 1.6.2 | 1.6.3 |
github.com/cea-hpc/sshproxyGo |
before 1.6.3 | 1.6.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-34713 is a low vulnerability (CVSS 3.5) in Cea-hpc Sshproxy, published May 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in github.com/cea-hpc/sshproxy 1.6.3.
References
github.com/cea-hpc/sshproxy/security/advisories/GHSA-jmqp-37m5-49wh
nvd.nist.gov/vuln/detail/CVE-2024-34713