Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

References

bugzilla.redhat.com/show_bug.cgi?id=1486685

prion 7

ubuntucve 7

openvas 40

nessus 51

cve 7

debiancve 7

osv 15

veracode 4

redhatcve 5

github 1

debian 12

hackerone 1

archlinux 2

freebsd 2

myhack58 1

ubuntu 3

cbl_mariner 1

fedora 7

suse 5

redhat 2

centos 2

alpinelinux 3

gentoo 2

mageia 3

checkpoint_advisories 2

cloudfoundry 1

slackware 1

oraclelinux 2

packetstorm 1

amazon 1

metasploit 1

prion

Design/Logic Flaw

2017-11-27 10:29:00

Design/Logic Flaw

2017-10-29 20:29:00

Design/Logic Flaw

2017-12-07 18:29:00

ubuntucve

CVE-2017-14176

2017-09-05 00:00:00

CVE-2017-16228

2017-10-29 00:00:00

CVE-2017-17459

2017-12-07 00:00:00

openvas

Huawei EulerOS: Security Advisory for bzr (EulerOS-SA-2021-1060)

2021-01-19 00:00:00

Huawei EulerOS: Security Advisory for bzr (EulerOS-SA-2021-1283)

2021-02-22 00:00:00

Huawei EulerOS: Security Advisory for bzr (EulerOS-SA-2021-1180)

2021-02-05 00:00:00

nessus

EulerOS 2.0 SP3 : bzr (EulerOS-SA-2021-1060)

2021-01-20 00:00:00

EulerOS 2.0 SP5 : bzr (EulerOS-SA-2021-1180)

2021-02-04 00:00:00

EulerOS 2.0 SP2 : bzr (EulerOS-SA-2021-1283)

2021-02-22 00:00:00

cve

CVE-2017-14176

2017-11-27 10:29:00

CVE-2017-16228

2017-10-29 20:29:00

CVE-2017-17459

2017-12-07 18:29:00

debiancve

CVE-2017-14176

2017-11-27 10:29:00

CVE-2017-16228

2017-10-29 20:29:00

CVE-2017-17459

2017-12-07 18:29:00

osv

PYSEC-2017-12

2017-10-29 20:29:00

Dulwich RCE Vulnerability

2022-05-13 01:44:04

CVE-2017-16228

2017-10-29 20:29:00

veracode

Arbitrary Command Execution

2017-10-30 00:47:04

Arbitrary Code Execution

2020-12-06 03:43:56

Arbitrary Code Execution

2020-08-06 21:38:56

redhatcve

CVE-2017-16228

2017-11-03 14:19:26

CVE-2017-12836

2017-08-11 22:48:33

CVE-2017-1000116

2017-08-10 19:18:29

github

Dulwich RCE Vulnerability

2022-05-13 01:44:04

debian

[SECURITY] [DLA 1144-1] git-annex security update

2017-10-27 15:29:08

[SECURITY] [DLA 1495-1] git-annex security update

2018-09-05 19:28:50

[SECURITY] [DLA 1072-1] mercurial security update

2017-08-31 11:57:25

hackerone

Internet Bug Bounty: RCE via ssh:// URIs in multiple VCS

2017-08-14 20:53:18

archlinux

[ASA-201708-7] mercurial: multiple issues

2017-08-12 00:00:00

[ASA-201708-6] git: arbitrary command execution

2017-08-12 00:00:00

freebsd

Mercurial -- multiple vulnerabilities

2017-08-10 00:00:00

cvs -- Remote code execution via ssh command injection

2017-08-10 00:00:00

myhack58

More mainstream version control system was traced to the presence of the client arbitrary code execution vulnerability-vulnerability warning-the black bar safety net

2017-08-11 00:00:00

ubuntu

Bazaar vulnerability

2017-10-24 00:00:00

Git vulnerability

2017-08-11 00:00:00

cvs vulnerability

2017-08-21 00:00:00

cbl_mariner

CVE-2017-14176 affecting package bzr 2.7.0-

2024-04-26 09:06:30

fedora

[SECURITY] Fedora 26 Update: cvs-1.11.23-42.fc26

2017-08-29 15:20:16

[SECURITY] Fedora 25 Update: cvs-1.11.23-41.fc25

2017-08-29 20:25:52

[SECURITY] Fedora 27 Update: git-annex-6.20170925-3.fc27

2017-11-14 15:34:17

suse

Security update for git (important)

2017-08-17 00:08:53

Security update for git (important)

2017-08-21 18:07:57

Security update for python-dulwich (moderate)

2018-08-06 15:16:15

redhat

(RHSA-2017:2485) Important: git security update

2017-08-16 21:46:48

(RHSA-2017:2484) Important: git security update

2017-08-16 21:46:19

centos

emacs, git, gitk, gitweb, perl security update

2017-08-17 10:26:34

emacs, git, gitk, gitweb, perl security update

2017-08-24 09:43:50

alpinelinux

CVE-2017-1000117

2017-10-05 01:29:00

CVE-2017-12836

2017-08-24 14:29:00

CVE-2017-1000116

2017-10-05 01:29:00

gentoo

CVS: Command injection

2017-09-24 00:00:00

Git: Command injection

2017-09-17 00:00:00

mageia

Updated cvs package fixes security vulnerability

2017-08-19 13:16:28

Updated python-dulwich packages fix security vulnerability

2018-11-12 00:39:12

Updated git packages fix security vulnerability

2017-08-14 01:19:29

checkpoint_advisories

Git ssh URL Processing Command Execution (CVE-2017-1000117)

2018-05-02 00:00:00

Apache Subversion svn-ssh URL Command Execution (CVE-2017-9800)

2017-08-29 00:00:00

cloudfoundry

USN-3387-1: Git vulnerability | Cloud Foundry

2017-08-17 00:00:00

slackware

[slackware-security] git

2017-08-11 23:10:53

oraclelinux

git security update

2017-08-17 00:00:00

git security update

2017-08-16 00:00:00

packetstorm

Malicious GIT HTTP Server

2017-08-30 00:00:00

amazon

Important: git

2017-08-31 16:00:00

metasploit

Malicious Git HTTP Server For CVE-2017-1000117

2017-08-13 03:47:44

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

JSON

Related for RH:CVE-2017-14176