Source: gh Version: 2.46.0-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for gh. CVE-2024-52308[0]: | The GitHub CLI version 2.6.1 and earlier are vulnerable to remote | code execution through a malicious codespace SSH server when using | `gh codespace ssh` or `gh codespace logs` commands. This has been | patched in the cli v2.62.0. Developers connect to remote codespaces | through an SSH server running within the devcontainer, which is | generally provided through the [default devcontainer image]( | https://docs.github.com/en/codespaces/setting-up-your-project-for- | codespaces/adding-a-dev-container-... | https://docs.github.com/en/codespaces/setting-up-your-project-for- | codespaces/adding-a-dev-container-configuration/introduction-to-dev- | containers#using-the-default-dev-container-configuration) . GitHub | CLI [retrieves SSH connection details]( https://github.com/cli/cli/b | lob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc | /inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144 | 300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as | remote username, which is used in [executing `ssh` commands]( https: | //github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/p | kg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c6 | 9a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) | for `gh codespace ssh` or `gh codespace logs` commands. This | exploit occurs when a malicious third-party devcontainer contains a | modified SSH server that injects `ssh` arguments within the SSH | connection details. `gh codespace ssh` and `gh codespace logs` | commands could execute arbitrary code on the user's workstation if | the remote username contains something like `-oProxyCommand="echo | hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the | provided command while `#` shell comment causes any other `ssh` | arguments to be ignored. In `2.62.0`, the remote username | information is being validated before being used. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-52308 https://www.cve.org/CVERecord?id=CVE-2024-52308 [1] https://github.com/cli/cli/security/advisories/GHSA-p2h2-3vg9-4p87 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
