The Bastion
Approved changes feed: RSS · Atom
cpe:2.3:a:ovh:the-bastion:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Ovh (60c7ed83-eb85-56b7-b06f-0b1b9d5ebca8) |
|---|---|
| Product | The Bastion (927d2bcb-6cf2-5660-99b4-1cfbafd17402) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ovh/the-bastion |
purl2cpe | 2026-06-01 10:12:08.159053 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-59339 |
vulnerable | 2026-06-08 07:35:21.684556 |
The Bastion ttyrec files are not signed after encryption by the osh-encrypt-rsync script
MEDIUM (4.4)
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a helper to rotate, encrypt, sign, copy, and optionally move them to a remote storage periodically, if configured to. When running, the script properly rotates and encrypts the files using the provided GPG key(s), but silently fails to sign them, even if asked to.
Published: 2025-09-17T17:50:34.877Z
Updated: 2025-09-17T18:09:55.732Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-45140 |
vulnerable | 2026-06-08 06:12:42.038371 |
Group-based JIT MFA bypass on scp and sftp in The Bastion
MEDIUM (4.8)
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.
Published: 2023-11-08T15:26:26.584Z
Updated: 2024-09-12T19:10:42.145Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.