Dulwich RCE Vulnerability
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-16228US | critical9.8 | — | ||
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a relate… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/jelmer/dulwichPACKAGE
- https://github.com/jelmer/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2017-12.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-16228ADVISORY
- https://tracker.debian.org/news/882440WEB
- https://web.archive.org/web/20201220231743/https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6WEB
- https://web.archive.org/web/20210128154006/https://www.dulwich.io/code/dulwichWEB
- https://www.dulwich.io/code/dulwichWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan