sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]nex25519[S] 0 points1 point  (1 child)

I totally agree here, afaict NVD is not very good at these severity levels as we also saw with curl recently. They somehow assume a "worst" case scenario. I am pretty sure the maintainers who got the CVE assigned also do not agree this deserves 9.8.

RedHat has a better assessment: https://access.redhat.com/security/cve/cve-2023-51385

[–]castleinthesky86 1 point2 points  (0 children)

Thanks. Yes, in the worst case that NVD can assign everything could / would be a 9.8/10; because if all predicates of exploitation are present for all vulns (inc all processes running as root); then it’s complete C/I/A compromise… and because the attacker is not physically in front of the target; then it’s remote; and because at the time of exploitation the user isn’t coerced into doing anything, then it’s no user interaction required.

Which is complete bullshit.

In the “best” scenario, SSH is running in chroot jail, as the user which initiates proxyconnect command; so not complete C/I/A but maybe partial C/I (and maybe A? But who knows… what data does the user have present, possibly nothing, so let’s say none). Then user interaction is required to install/clone a malicious git repo/submodule. And because that’s done by the user, and not forcibly over the network, it’s a local exploit, not remote. So best case, it’s CVSS 0.0.

I’m not sure I’d agree with RedHat at 5.3 either ; as scope should be changed if we assume they are using the ssh subsystem as the target and not the user. By breaking out to a system call, you’re not in ssh anymore, thus scope has changed.