Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.

OSVersionArchitecturePackageVersionFilename
Debian12alldulwich< 0.18.5-1dulwich_0.18.5-1_all.deb
Debian11alldulwich< 0.18.5-1dulwich_0.18.5-1_all.deb
Debian10alldulwich< 0.18.5-1dulwich_0.18.5-1_all.deb
Debian999alldulwich< 0.18.5-1dulwich_0.18.5-1_all.deb
Debian13alldulwich< 0.18.5-1dulwich_0.18.5-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	dulwich	< 0.18.5-1	dulwich_0.18.5-1_all.deb
Debian	11	all	dulwich	< 0.18.5-1	dulwich_0.18.5-1_all.deb
Debian	10	all	dulwich	< 0.18.5-1	dulwich_0.18.5-1_all.deb
Debian	999	all	dulwich	< 0.18.5-1	dulwich_0.18.5-1_all.deb
Debian	13	all	dulwich	< 0.18.5-1	dulwich_0.18.5-1_all.deb

cve 8

veracode 3

osv 16

redhatcve 5

prion 8

ubuntucve 7

github 1

openvas 26

debian 12

nessus 58

debiancve 7

hackerone 1

archlinux 3

freebsd 3

myhack58 1

fedora 7

alpinelinux 3

gentoo 3

mageia 3

ubuntu 2

suse 5

redhat 2

centos 2

checkpoint_advisories 1

cloudfoundry 1

slackware 1

oraclelinux 3

packetstorm 1

amazon 1

metasploit 1

ibm 2

zdt 1

f5 1

cve

CVE-2017-16228

2017-10-29 20:29:00

CVE-2017-12976

2017-08-20 20:29:00

CVE-2017-14176

2017-11-27 10:29:00

veracode

Arbitrary Command Execution

2017-10-30 00:47:04

Arbitrary Code Execution

2020-08-06 21:38:56

Remote Code Execution (RCE)

2019-01-15 09:18:24

osv

PYSEC-2017-12

2017-10-29 20:29:00

Dulwich RCE Vulnerability

2022-05-13 01:44:04

CVE-2017-16228

2017-10-29 20:29:00

redhatcve

CVE-2017-16228

2017-11-03 14:19:26

CVE-2017-14176

2017-09-12 07:48:25

CVE-2017-12836

2017-08-11 22:48:33

prion

Design/Logic Flaw

2017-10-29 20:29:00

Sql injection

2017-08-20 20:29:00

Design/Logic Flaw

2017-11-27 10:29:00

ubuntucve

CVE-2017-16228

2017-10-29 00:00:00

CVE-2017-12976

2017-08-20 00:00:00

CVE-2017-14176

2017-09-05 00:00:00

github

Dulwich RCE Vulnerability

2022-05-13 01:44:04

openvas

Debian LTS: Security Advisory for git-annex (DLA-1144-1)

2018-02-07 00:00:00

Debian LTS: Security Advisory for git-annex (DLA-1495-1)

2018-09-06 00:00:00

Debian LTS: Security Advisory for mercurial (DLA-1072-1)

2018-02-07 00:00:00

debian

[SECURITY] [DLA 1144-1] git-annex security update

2017-10-27 15:29:08

[SECURITY] [DLA 1495-1] git-annex security update

2018-09-05 19:28:50

[SECURITY] [DLA 1072-1] mercurial security update

2017-08-31 11:57:25

nessus

Debian DLA-1144-1 : git-annex security update

2017-10-30 00:00:00

EulerOS 2.0 SP5 : bzr (EulerOS-SA-2021-1180)

2021-02-04 00:00:00

EulerOS 2.0 SP2 : bzr (EulerOS-SA-2021-1283)

2021-02-22 00:00:00

debiancve

CVE-2017-12976

2017-08-20 20:29:00

CVE-2017-14176

2017-11-27 10:29:00

CVE-2017-17459

2017-12-07 18:29:00

hackerone

Internet Bug Bounty: RCE via ssh:// URIs in multiple VCS

2017-08-14 20:53:18

archlinux

[ASA-201708-7] mercurial: multiple issues

2017-08-12 00:00:00

[ASA-201708-6] git: arbitrary command execution

2017-08-12 00:00:00

[ASA-201708-14] subversion: arbitrary command execution

2017-08-15 00:00:00

freebsd

Mercurial -- multiple vulnerabilities

2017-08-10 00:00:00

cvs -- Remote code execution via ssh command injection

2017-08-10 00:00:00

subversion -- Arbitrary code execution vulnerability

2017-08-10 00:00:00

myhack58

More mainstream version control system was traced to the presence of the client arbitrary code execution vulnerability-vulnerability warning-the black bar safety net

2017-08-11 00:00:00

fedora

[SECURITY] Fedora 25 Update: cvs-1.11.23-41.fc25

2017-08-29 20:25:52

[SECURITY] Fedora 26 Update: cvs-1.11.23-42.fc26

2017-08-29 15:20:16

[SECURITY] Fedora 25 Update: git-2.9.5-1.fc25

2017-08-14 00:56:27

alpinelinux

CVE-2017-12836

2017-08-24 14:29:00

CVE-2017-1000117

2017-10-05 01:29:00

CVE-2017-1000116

2017-10-05 01:29:00

gentoo

CVS: Command injection

2017-09-24 00:00:00

Git: Command injection

2017-09-17 00:00:00

Subversion: Arbitrary code execution

2017-09-17 00:00:00

mageia

Updated cvs package fixes security vulnerability

2017-08-19 13:16:28

Updated python-dulwich packages fix security vulnerability

2018-11-12 00:39:12

Updated git packages fix security vulnerability

2017-08-14 01:19:29

ubuntu

cvs vulnerability

2017-08-21 00:00:00

Git vulnerability

2017-08-11 00:00:00

suse

Security update for python-dulwich (moderate)

2018-08-06 15:16:15

Security update for git (important)

2017-08-17 00:08:53

Security update for git (important)

2017-08-21 18:07:57

redhat

(RHSA-2017:2485) Important: git security update

2017-08-16 21:46:48

(RHSA-2017:2484) Important: git security update

2017-08-16 21:46:19

centos

emacs, git, gitk, gitweb, perl security update

2017-08-17 10:26:34

emacs, git, gitk, gitweb, perl security update

2017-08-24 09:43:50

checkpoint_advisories

Git ssh URL Processing Command Execution (CVE-2017-1000117)

2018-05-02 00:00:00

cloudfoundry

USN-3387-1: Git vulnerability | Cloud Foundry

2017-08-17 00:00:00

slackware

[slackware-security] git

2017-08-11 23:10:53

oraclelinux

git security update

2017-08-17 00:00:00

git security update

2017-08-16 00:00:00

subversion security update

2017-08-15 00:00:00

packetstorm

Malicious GIT HTTP Server

2017-08-30 00:00:00

amazon

Important: git

2017-08-31 16:00:00

metasploit

Malicious Git HTTP Server For CVE-2017-1000117

2017-08-13 03:47:44

ibm

Security Bulletin: A vulnerability in subversion affects PowerKVM

2018-06-18 01:38:34

Security Bulletin: IBM QRadar Network Security is affected by vulnerability in subversion (CVE-2017-9800)

2018-06-16 22:03:31

zdt

Apache Subversion Arbitrary Code Execution Vulnerability

2017-08-14 00:00:00

K45625134 : Apache Subversion vulnerability CVE-2017-9800

2017-08-29 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.004 Low

EPSS

Percentile

72.1%

JSON

Related for DEBIANCVE:CVE-2017-16228