Read the docs
TI-2014-02035 Aliases CVE-2014-2532GHSA-qf84-3fjj-8852

sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in…

Priority LOW 27CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 8 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-266 and CWE-264.

Summary

sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04751 91st percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 8 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:*10.0.1VulnerableOracle
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*up to 6.5VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:6.0:*:*:*:*:*:*:*6.0VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:6.1:*:*:*:*:*:*:*6.1VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:6.2:*:*:*:*:*:*:*6.2VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:6.3:*:*:*:*:*:*:*6.3VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:6.4:*:*:*:*:*:*:*6.4VulnerableOpenBSD
  • cpe:2.3:a:oracle:communications_user_data_repository:10.0.1:*:*:*:*:*:*:* Versions 10.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* Versions up to 6.5 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·OpenBSD

Remediation

Red Hat 1 advisory

  • RHSA-2014:1552 Released 2014-10-13 · Red Hat rating Moderate
    openssh security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) openssh-5.3p1-104.el6, openssh-askpass-5.3p1-104.el6, openssh-clients-5.3p1-104.el6 +1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) openssh-ldap-5.3p1-104.el6, pam_ssh_agent_auth-0.9.3-104.el6
    • Red Hat Enterprise Linux HPC Node (v. 6) openssh-5.3p1-104.el6, openssh-clients-5.3p1-104.el6, openssh-server-5.3p1-104.el6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) openssh-askpass-5.3p1-104.el6, openssh-ldap-5.3p1-104.el6, pam_ssh_agent_auth-0.9.3-104.el6
    • Red Hat Enterprise Linux Server (v. 6) openssh-5.3p1-104.el6, openssh-askpass-5.3p1-104.el6, openssh-clients-5.3p1-104.el6 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) openssh-ldap-5.3p1-104.el6, pam_ssh_agent_auth-0.9.3-104.el6, pam_ssh_agent_auth-0.9.3-104.el6.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) openssh-5.3p1-104.el6, openssh-askpass-5.3p1-104.el6, openssh-clients-5.3p1-104.el6 +1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) openssh-ldap-5.3p1-104.el6, pam_ssh_agent_auth-0.9.3-104.el6

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1552
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:1552
Not affected: 1 product
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-2532
  2. 2026-10-03 Alias added: GHSA-qf84-3fjj-8852

References

Advisory 9

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences