p PatchFirst

CVE-2017-14176

CVE-2017-14176

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

CVSS 8.8 · High · EPSS 6.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • bazaar through 2.7.0

    Versions
    • Bazaar through 2.7.0: Affected

    No fix published

  • breezy Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.0.0~bzr6772-1

    Update to 3.0.0~bzr6772-1

  • breezy Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.0.0~bzr6772-1

    Update to 3.0.0~bzr6772-1

  • breezy Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.0.0~bzr6772-1

    Update to 3.0.0~bzr6772-1

  • bzr Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.7.0+bzr6622-7

    Update to 2.7.0+bzr6622-7

  • bzr Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.7.0+bzr6622-7

    Update to 2.7.0+bzr6622-7

  • bzr PyPI

    Versions
    • 2.6.0
    • 2.7.0
    Affected ranges
    • ECOSYSTEM: ≤ 2.7.0

    No fix published

  • bzr PyPI

    No fix published

  • bzr Ubuntu:14.04:LTS

    Versions
    • 2.6.0-3ubuntu1
    • 2.6.0-3ubuntu2
    • 2.6.0+bzr6591-1ubuntu1
    • 2.6.0+bzr6593-1ubuntu1
    • 2.6.0+bzr6593-1ubuntu1.1
    • 2.6.0+bzr6593-1ubuntu1.5
    Affected ranges
    • ECOSYSTEM: < 2.6.0+bzr6593-1ubuntu1.6

    Update to 2.6.0+bzr6593-1ubuntu1.6

  • bzr Ubuntu:16.04:LTS

    Versions
    • 2.6.0+bzr6602-2ubuntu4
    • 2.6.0+bzr6606-2ubuntu1
    • 2.7.0-2ubuntu1
    • 2.7.0-2ubuntu2
    • 2.7.0-2ubuntu3
    Affected ranges
    • ECOSYSTEM: < 2.7.0-2ubuntu3.1

    Update to 2.7.0-2ubuntu3.1

Original sources

Check your server →