Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-24950: A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other sys...

CVE-2022-24950 · published 4 years ago

Summary

A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorization socket, enabling the attacker to login to other systems as the targeted users. The bug is in UserTerminalRouter::getInfoForId().

What to do

Update eternal_terminal_project eternal_terminal to version 6.2.0 or later.

Affected software

Vendor	Product	Affected versions
eternal_terminal_project	eternal_terminal	< 6.2.0 `cpe:2.3:a:eternal_terminal_project:eternal_terminal::::::::`

Original advisory text

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-85g... Vendor Advisory
https://github.com/MisterTea/EternalTerminal/commit/900348bb8bc96e1c7ba4888ac848... Patch
http://www.openwall.com/lists/oss-security/2023/02/16/1 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24950... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-24950 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-362Race Condition

Timeline

Published16 Aug 2022

Updated2 Nov 2026

First seen29 Sep 2026

Sources

CVE-2022-24950 · NVD

CVE-2022-24950 · OSV

GHSA-85gw-pchc-4rf3 · GHSA

Track software like this

Free during beta