What’s Vulnerable › Vulnerabilities

CVE-2014-2532

• Severity: medium (CVSS 4.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-03-18 · updated 2026-06-17
• Weakness: CWE-264

Description

sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.

Affected products

• OpenSSH: through 6.5; 6.0, 6.1, 6.2, 6.3, 6.4
• Oracle Communications User Data Repository: 10.0.1

References

• http://advisories.mageia.org/MGASA-2014-0143.html
• http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html
• http://marc.info/?l=bugtraq&m=141576985122836&w=2
• http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2
• http://rhn.redhat.com/errata/RHSA-2014-1552.html
• http://secunia.com/advisories/57488
• http://secunia.com/advisories/57574
• http://secunia.com/advisories/59313
• http://secunia.com/advisories/59855

Get alerted when CVE-2014-2532 or the next vulnerability affects your stack