Original description
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions.
Affected software
- OpenSSH ≤ 7.2 exact match
Details
- Published
- 2016-03-22
- Last modified
- 2026-06-17
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N- CWE
- CWE-93
References
- cve.org/CVE-2016-3115
- nvd.nist.gov/vuln/detail/CVE-2016-3115
- cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c
- cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/session.c.diff?r1=1.281&r2=1.282&f=h
- lists.fedoraproject.org/pipermail/package-announce/2016-April/183101.html
- lists.fedoraproject.org/pipermail/package-announce/2016-April/183122.html
- lists.fedoraproject.org/pipermail/package-announce/2016-March/178838.html
- lists.fedoraproject.org/pipermail/package-announce/2016-March/179924.html
- lists.fedoraproject.org/pipermail/package-announce/2016-March/180491.html
- lists.fedoraproject.org/pipermail/package-announce/2016-May/184264.html
- packetstormsecurity.com/files/136234/OpenSSH-7.2p1-xauth-Command-Injection-Bypass.html
- rhn.redhat.com/errata/RHSA-2016-0465.html
- rhn.redhat.com/errata/RHSA-2016-0466.html
- seclists.org/fulldisclosure/2016/Mar/46
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.