GitHub Advisoryadvisory · PyPI

GHSA-cwwh-4382-6fwr Dulwich RCE Vulnerability

CRITICAL Published 2022-05-13 Modified 2024-09-20 Official page ↗
Aliases
CVE-2017-16228
Ecosystem
PyPI
Packages
dulwich
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed
2023-07-26

Affected packages

• PyPI dulwich: < 0.18.5 → fixed in 0.18.5

Description

Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.

Related

Alias · CVE (1)

  • CVE-2017-16228 Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial… vulnerability

References