On: SSH ProxyCommand == unexpected code execution (CVE...

[bdd8f1df777b]

Wow, this is a security vulnerability potentially affecting me. I'm using ProxyCommand because GitHub is randomly blocked by the China GFW.

[leftcenterright → bdd8f1df777b]

This is interesting insight, would you care to share some parts of your ssh config indicating how you use ssh over a proxy here, most likely through a VPN?

[bdd8f1df777b → leftcenterright]

```

Host github.com

    ProxyCommand connect -H localhost:54321 %h %p

```

localhost:54321 is a SOCK5 proxy, which forwards the traffic through TLS to my VPS server.

[acheong08 → bdd8f1df777b]

It doesn’t affect you as it only works when your proxy string comes from an untrusted source.

[zeroimpl → bdd8f1df777b]

Try ProxyJump instead - it’s the newer way of doing it.

[bdd8f1df777b → zeroimpl]

ProxyJump is to connect to one SSH server by another SSH, right? It doesn't work against GFW. GFW throttles SSH traffic across borders to ensure that SSH can only be used for running commands rather than tunneling data.

[zeroimpl → bdd8f1df777b]

Yeah I assumed that's what you were doing, since you mentioned Github blocked specifically. If you need to proxy through a protocol other than SSH, likely need to keep using ProxyCommand.