CVE-2024-34713: Cea-Hpc Sshproxy

Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days.

sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.3, any user authorized to connect to a ssh server using `sshproxy` can inject options to the `ssh` command executed by `sshproxy`. All versions of `sshproxy` are impacted. The problem is patched starting in version 1.6.3. The only workaround is to use the `force_command` option in `sshproxy.yaml`, but it's rarely relevant.

Affected products

• Cea-Hpc Sshproxy: before 1.6.3 (fixed in 1.6.3)

Published 2024-05-14. Last modified 2026-06-17.