CVE-2017-12836

CVE-2017-12836 affects CVS 1.12.x when configured to use SSH for remote repositories. A remote attacker can supply a repository URL with a crafted hostname (for example, a string that triggers -oProxyCommand) to cause arbitrary code execution on the target. This is evidenced by cross-references i...