Dulwich RCE Vulnerability
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-16228US | critical9.8 | — | ||
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a relate… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/jelmer/dulwichPACKAGE
- https://github.com/jelmer/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2017-12.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-16228ADVISORY
- https://tracker.debian.org/news/882440WEB
- https://web.archive.org/web/20201220231743/https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6WEB
- https://web.archive.org/web/20210128154006/https://www.dulwich.io/code/dulwichWEB
- https://www.dulwich.io/code/dulwichWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan