CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by -oProxyCommand=id;localhost:/bar.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cvs | Gnu | 1.12.1 (including) | 1.12.1 (including) |
| Cvs | Gnu | 1.12.3 (including) | 1.12.3 (including) |
| Cvs | Gnu | 1.12.5 (including) | 1.12.5 (including) |
| Cvs | Gnu | 1.12.6 (including) | 1.12.6 (including) |
| Cvs | Gnu | 1.12.7 (including) | 1.12.7 (including) |
| Cvs | Gnu | 1.12.9 (including) | 1.12.9 (including) |
| Cvs | Gnu | 1.12.10 (including) | 1.12.10 (including) |
| Cvs | Gnu | 1.12.11 (including) | 1.12.11 (including) |
| Cvs | Gnu | 1.12.12 (including) | 1.12.12 (including) |
| Cvs | Gnu | 1.12.13 (including) | 1.12.13 (including) |