Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.

CPENameOperatorVersion
dulwicheq0.11.1
dulwicheq0.18.1
dulwicheq0.9.9
dulwicheq0.16.0
dulwicheq0.17.1
dulwicheq0.8.3
dulwicheq0.9.1
dulwicheq0.7.0
dulwicheq0.6.0
dulwicheq0.12.0

Name	Operator	Version
dulwich	eq	0.11.1
dulwich	eq	0.18.1
dulwich	eq	0.9.9
dulwich	eq	0.16.0
dulwich	eq	0.17.1
dulwich	eq	0.8.3
dulwich	eq	0.9.1
dulwich	eq	0.7.0
dulwich	eq	0.6.0
dulwich	eq	0.12.0

Rows per page:

1-10 of 561

References

tracker.debian.org/news/882440

www.dulwich.io/code/dulwich/

www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/

osv 14

veracode 3

redhatcve 5

prion 8

ubuntucve 7

github 1

cve 8

debiancve 7

nessus 52

debian 12

openvas 39

hackerone 1

archlinux 3

freebsd 3

myhack58 1

fedora 6

suse 5

ubuntu 2

centos 2

alpinelinux 3

redhat 2

checkpoint_advisories 1

mageia 3

cloudfoundry 1

slackware 1

gentoo 3

oraclelinux 2

packetstorm 1

amazon 1

metasploit 1

zdt 1

osv

Dulwich RCE Vulnerability

2022-05-13 01:44:04

CVE-2017-16228

2017-10-29 20:29:00

git-annex command injection via malicious SSH hostname

2023-07-25 13:25:42

veracode

Arbitrary Command Execution

2017-10-30 00:47:04

Arbitrary Code Execution

2020-08-06 21:38:56

Remote Code Execution (RCE)

2019-01-15 09:18:24

redhatcve

CVE-2017-16228

2017-11-03 14:19:26

CVE-2017-14176

2017-09-12 07:48:25

CVE-2017-12836

2017-08-11 22:48:33

prion

Design/Logic Flaw

2017-10-29 20:29:00

Sql injection

2017-08-20 20:29:00

Design/Logic Flaw

2017-11-27 10:29:00

ubuntucve

CVE-2017-16228

2017-10-29 00:00:00

CVE-2017-12976

2017-08-20 00:00:00

CVE-2017-14176

2017-09-05 00:00:00

github

Dulwich RCE Vulnerability

2022-05-13 01:44:04

cve

CVE-2017-16228

2017-10-29 20:29:00

CVE-2017-12976

2017-08-20 20:29:00

CVE-2017-14176

2017-11-27 10:29:00

debiancve

CVE-2017-16228

2017-10-29 20:29:00

CVE-2017-12976

2017-08-20 20:29:00

CVE-2017-14176

2017-11-27 10:29:00

nessus

Debian DLA-1144-1 : git-annex security update

2017-10-30 00:00:00

EulerOS 2.0 SP3 : bzr (EulerOS-SA-2021-1060)

2021-01-20 00:00:00

EulerOS 2.0 SP5 : bzr (EulerOS-SA-2021-1180)

2021-02-04 00:00:00

debian

[SECURITY] [DLA 1144-1] git-annex security update

2017-10-27 15:29:08

[SECURITY] [DLA 1495-1] git-annex security update

2018-09-05 19:28:50

[SECURITY] [DLA 1072-1] mercurial security update

2017-08-31 11:57:25

openvas

Debian: Security Advisory (DLA-1144-1)

2018-02-06 00:00:00

Huawei EulerOS: Security Advisory for bzr (EulerOS-SA-2021-1060)

2021-01-19 00:00:00

Huawei EulerOS: Security Advisory for bzr (EulerOS-SA-2021-1283)

2021-02-22 00:00:00

hackerone

Internet Bug Bounty: RCE via ssh:// URIs in multiple VCS

2017-08-14 20:53:18

archlinux

[ASA-201708-7] mercurial: multiple issues

2017-08-12 00:00:00

[ASA-201708-6] git: arbitrary command execution

2017-08-12 00:00:00

[ASA-201708-14] subversion: arbitrary command execution

2017-08-15 00:00:00

freebsd

Mercurial -- multiple vulnerabilities

2017-08-10 00:00:00

cvs -- Remote code execution via ssh command injection

2017-08-10 00:00:00

subversion -- Arbitrary code execution vulnerability

2017-08-10 00:00:00

myhack58

More mainstream version control system was traced to the presence of the client arbitrary code execution vulnerability-vulnerability warning-the black bar safety net

2017-08-11 00:00:00

fedora

[SECURITY] Fedora 25 Update: cvs-1.11.23-41.fc25

2017-08-29 20:25:52

[SECURITY] Fedora 26 Update: cvs-1.11.23-42.fc26

2017-08-29 15:20:16

[SECURITY] Fedora 27 Update: git-annex-6.20170925-3.fc27

2017-11-14 15:34:17

suse

Security update for git (important)

2017-08-17 00:08:53

Security update for git (important)

2017-08-21 18:07:57

Security update for python-dulwich (moderate)

2018-08-06 15:16:15

ubuntu

Git vulnerability

2017-08-11 00:00:00

cvs vulnerability

2017-08-21 00:00:00

centos

emacs, git, gitk, gitweb, perl security update

2017-08-17 10:26:34

emacs, git, gitk, gitweb, perl security update

2017-08-24 09:43:50

alpinelinux

CVE-2017-1000117

2017-10-05 01:29:00

CVE-2017-1000116

2017-10-05 01:29:00

CVE-2017-12836

2017-08-24 14:29:00

redhat

(RHSA-2017:2485) Important: git security update

2017-08-16 21:46:48

(RHSA-2017:2484) Important: git security update

2017-08-16 21:46:19

checkpoint_advisories

Git ssh URL Processing Command Execution (CVE-2017-1000117)

2018-05-02 00:00:00

mageia

Updated git packages fix security vulnerability

2017-08-14 01:19:29

Updated cvs package fixes security vulnerability

2017-08-19 13:16:28

Updated python-dulwich packages fix security vulnerability

2018-11-12 00:39:12

cloudfoundry

USN-3387-1: Git vulnerability | Cloud Foundry

2017-08-17 00:00:00

slackware

[slackware-security] git

2017-08-11 23:10:53

gentoo

CVS: Command injection

2017-09-24 00:00:00

Git: Command injection

2017-09-17 00:00:00

Subversion: Arbitrary code execution

2017-09-17 00:00:00

oraclelinux

git security update

2017-08-17 00:00:00

git security update

2017-08-16 00:00:00

packetstorm

Malicious GIT HTTP Server

2017-08-30 00:00:00

amazon

Important: git

2017-08-31 16:00:00

metasploit

Malicious Git HTTP Server For CVE-2017-1000117

2017-08-13 03:47:44

zdt

Apache Subversion Arbitrary Code Execution Vulnerability

2017-08-14 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.552 Medium

EPSS

Percentile

97.6%

JSON

Related for OSV:PYSEC-2017-12