Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Dulwich | Dulwich_project | * | 0.18.4 (including) |
| Dulwich | Ubuntu | artful | * |
| Dulwich | Ubuntu | esm-apps/xenial | * |
| Dulwich | Ubuntu | trusty | * |
| Dulwich | Ubuntu | upstream | * |
| Dulwich | Ubuntu | xenial | * |
| Dulwich | Ubuntu | zesty | * |
References
- https://tracker.debian.org/news/882440
- https://www.dulwich.io/code/dulwich/
- https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
- https://tracker.debian.org/news/882440
- https://www.dulwich.io/code/dulwich/
- https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/