CVE-2014-2532 Security feature bypass in n/a

Medium 4.2 Published 18 Mar 2014 Updated 28 May 2026

Remote attackers can bypass environment restrictions in OpenSSH by exploiting improper wildcard handling in AcceptEnv configurations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-2532?

CVE-2014-2532 is a medium-severity vulnerability in OpenSSH, published on 18 Mar 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.

Weakness: CWE-264, CWE-266, CWE-20

Which versions are affected by CVE-2014-2532?

It affects 2 products.

Products include OpenSSH, Oracle Communications User Data Repository.

How do I fix CVE-2014-2532?

Upgrade to a fixed version.

Is CVE-2014-2532 being exploited?

There is no known exploitation of CVE-2014-2532 in the wild and no public exploit code.

All OpenSSH vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-2532, GHSA-qf84-3fjj-8852, MGASA-2014-0143.