CVE-2008-1657: OpenBSD OpenSSH

Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days.

OpenSSH 4.4 up to versions before 4.9 allows remote authenticated users to bypass the sshd_config ForceCommand directive by modifying the .ssh/rc session file.

Affected products

• OpenBSD OpenSSH: version 4.4 only; version 4.4p1 only; version 4.5 only; version 4.6 only; version 4.7 only; version 4.8 only

Published 2008-04-02. Last modified 2026-06-16.