Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-3463 — Argument Injection in GNU Linux Rssh

CWE-88 — Argument Injection8 documents6 sources
Severity
9.8CRITICALNVD
EPSS
12.8%
top 5.96%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
6
RsshDebian GNU Linux RsshCanonical Ubuntu Linux+3 more
Timeline
PublishedFeb 6
Latest updateApr 16

Description

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶Alpinerssh/rssh< 2.3.4-r2+9
▶NVDpizzashack/rssh2.3.4
▶CVEListV5debian_gnu/linux_rsshAll versions before 2.3.4-5+deb9u2 and 2.3.4-10

Also affects: Debian Linux 8.0, 9.0, Fedora 29, 30, 31, Ubuntu Linux 14.04, 16.04, 18.04, 18.10

🔴Vulnerability Details

2
GHSA
GHSA-vx65-qfv7-jcf4: Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to p↗2022-05-13
▶
OSV
CVE-2019-3463: Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to p↗2019-02-06
▶

💥Exploits & PoCs

1
Exploit-DB
Ruckus IoT Controller 1.7.1.0 - Undocumented Backdoor Account↗2025-04-16
▶

📋Vendor Advisories

1
Ubuntu
rssh vulnerabilities↗2019-04-11
▶

💬Community

3
Bugzilla
CVE-2019-3463 rssh: rsync bypass resulting in arbitrary code execution [fedora-all]↗2019-02-04
▶
Bugzilla
CVE-2019-3463 rssh: rsync bypass resulting in arbitrary code execution↗2019-02-04
▶
Bugzilla
CVE-2019-3463 rssh: rsync bypass resulting in arbitrary code execution [epel-all]↗2019-02-04
▶
CVE-2019-3463 — Argument Injection in GNU Linux Rssh | cvebase