A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.

A flaw was found in OpenSSH. A username entered on the ssh command line can still contain '$' or a non-trailing backslash. When a configuration expands %u inside ProxyCommand or Match exec, those characters are passed into the shell.

openssh: OpenSSH: Security restriction bypass via unenforced restrict directive in tunnel forwarding openssh: openssh: sftp can write outside the destination directory from a server-supplied path openssh: openssh: '$' and '\' in a command-line username expand through %u openssh: openssh: shared LZ77 compression dictionary leaks plaintext across channels openssh: openssh: a compressed payload can expand past the maximum packet size