Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.5
CVSSv3

CVE-2017-12836

Published: 24/08/2017 Updated: 03/10/2019
CVSS v2 Base Score: 5.1 | Impact Score: 6.4 | Exploitability Score: 4.9
CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6
VMScore: 454
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Subscribe to Gnu

Vulnerability Summary

CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote malicious users to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

gnu cvs 1.12.12

gnu cvs 1.12.6

gnu cvs 1.12.3

gnu cvs 1.12.11

gnu cvs 1.12.10

gnu cvs 1.12.9

gnu cvs 1.12.7

gnu cvs 1.12.13

gnu cvs 1.12.5

gnu cvs 1.12.1

canonical ubuntu linux 17.04

canonical ubuntu linux 14.04

canonical ubuntu linux 16.04

debian debian linux 9.0

debian debian linux 8.0

Vendor Advisories

Ubuntu Security Notice: cvs vulnerability
cvs could be made run programs as your login if it opened a specially crafted cvs repository ...
Debian CVElist Bug Report Logs: cvs: CVE-2017-12836: CVS and ssh command injection
Debian Bug report logs - #871810 cvs: CVE-2017-12836: CVS and ssh command injection Package: src:cvs; Maintainer for src:cvs is Thorsten Glaser <tg@mirbsdde>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 11 Aug 2017 19:42:02 UTC Severity: grave Tags: patch, security, upstream Found in version cv ...
Debian CVElist Bug Report Logs: git-annex: remote code execution via crafted SSH URLs (CVE-2017-12976)
Debian Bug report logs - #873088 git-annex: remote code execution via crafted SSH URLs (CVE-2017-12976) Package: git-annex; Maintainer for git-annex is Debian Haskell Group <pkg-haskell-maintainers@listsaliothdebianorg>; Source for git-annex is src:git-annex (PTS, buildd, popcon) Reported by: Antoine Beaupre <anarcat@o ...
Red Hat: CVE-2017-12836
CVS 112x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar" ...

References

NVD-CWE-noinfohttps://bugzilla.redhat.com/show_bug.cgi?id=1480800http://www.ubuntu.com/usn/USN-3399-1http://www.securityfocus.com/bid/100279http://www.openwall.com/lists/oss-security/2017/08/11/4http://www.openwall.com/lists/oss-security/2017/08/11/1http://www.debian.org/security/2017/dsa-3940http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.htmlhttps://security.gentoo.org/glsa/201709-17https://usn.ubuntu.com/3399-1/https://nvd.nist.gov
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-26925CVE-2023-41826LFICVE-2022-22364CVE-2024-2887command injectionremote code executionCVE-2024-34446CVE-2022-48699
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook