-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper subsystem validation in proxy mode. The commit diff shows the parseSubsystemRequest() function was modified to add strict proxy mode checks, rejecting non-proxy subsystems like SFTP. Pre-patch code (visible in diff line 2195-2204) lacked this strict filtering, allowing attackers to request SFTP subsystem on proxy servers. The added test TestParseSubsystemRequest in sshserver_test.go explicitly verifies this restriction, confirming SFTP is blocked in proxy mode post-fix.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gravitational/teleport | go | >= 14.0.0, < 14.2.4 | 14.2.4 |
| github.com/gravitational/teleport | go | >= 13.0.0, < 13.4.13 | 13.4.13 |
| github.com/gravitational/teleport | go | < 12.4.31 | 12.4.31 |
Ongoing coverage of React2Shell