Fluid Attacks Database

Description

check_by_ssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with ${IFS}. This has been categorized both as fixed in e8810de, and as intended behavior.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 12	monitoring-plugins	=2.3.3-5 \|\| =2.3.3-5+deb12u1 \|\| =2.3.3-5+deb12u2 \|\| =2.3.3-6 \|\| =2.3.5-1 \|\| =2.4.0-1 \|\| =2.4.0-2 \|\| =2.4.0-3 \|\| =2.4.0-3~exp1 \|\| =2.4.0-4 \|\| =2.4.0-5
debian 13	monitoring-plugins	=2.4.0-3 \|\| =2.4.0-3+deb13u1 \|\| =2.4.0-4 \|\| =2.4.0-5
debian 14	monitoring-plugins	=2.4.0-3 \|\| =2.4.0-4 \|\| =2.4.0-5

Aliases

1. CVE-2023-371542. NVD-2023-371543. OSV-DEBIAN-2023-371544. OSV-2023-371545. SECURITY-TRACKER-CVE-2023-37154

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.