CVE-2017-16228
CVE-2017-16228
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
CVSS 9.8 · Critical · EPSS 3.7% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
dulwich Debian:12
- Affected ranges
- ECOSYSTEM: < 0.18.5-1
Update to 0.18.5-1
dulwich Debian:13
- Affected ranges
- ECOSYSTEM: < 0.18.5-1
Update to 0.18.5-1
dulwich Debian:14
- Affected ranges
- ECOSYSTEM: < 0.18.5-1
Update to 0.18.5-1
dulwich PyPI
- Versions
- 0.0.1
- 0.1.0
- 0.1.1
- 0.10.0
- 0.10.1a
- 0.11.0
- 0.11.1
- 0.11.2
- 0.12.0
- 0.13.0
- 0.14.0
- 0.14.1
- 0.15.0
- 0.16.0
- 0.16.1
- 0.16.2
- 0.16.3
- 0.17.1
- 0.17.2
- 0.17.3
- 0.18.0
- 0.18.1
- 0.18.2
- 0.18.3
- 0.18.4
- 0.2.1
- 0.3.0
- 0.3.1
- 0.3.2
- 0.3.3
- 0.4.0
- 0.4.1
- 0.5.0
- 0.6.0
- 0.6.1
- 0.6.2
- 0.7.0
- 0.7.1
- 0.8.0
- 0.8.1
- 0.8.2
- 0.8.3
- 0.8.4
- 0.8.5
- 0.8.6
- 0.8.7
- 0.9.0
- 0.9.1
- 0.9.2
- 0.9.3
- 0.9.4
- 0.9.5
- 0.9.6
- 0.9.7
- 0.9.8
- 0.9.9
- Affected ranges
- ECOSYSTEM: < 0.18.5
Update to 0.18.5
dulwich Ubuntu:16.04:LTS
- Versions
- 0.11.2-1ubuntu1
- 0.12.0-1
- 0.12.0-1build1
- 0.12.0-1build2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published