CVE-2017-16228 Dulwich RCE Vulnerability
CriticalCVSS 9.8
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi dulwich(PyPI) | < 0.18.5 | 0.18.5 |
| pypi dulwich(PyPI) | = 0.0.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.1.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.1.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.10.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.10.1a | No fix listed |
| pypi dulwich(PyPI) | = 0.11.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.11.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.11.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.12.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.13.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.14.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.14.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.15.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.16.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.16.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.16.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.16.3 | No fix listed |
| pypi dulwich(PyPI) | = 0.17.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.17.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.17.3 | No fix listed |
| pypi dulwich(PyPI) | = 0.18.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.18.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.18.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.18.3 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi dulwich(PyPI) | = 0.18.4 | No fix listed |
| pypi dulwich(PyPI) | = 0.2.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.3.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.3.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.3.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.3.3 | No fix listed |
| pypi dulwich(PyPI) | = 0.4.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.4.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.5.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.6.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.6.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.6.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.7.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.7.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.3 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.4 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.5 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.6 | No fix listed |
| pypi dulwich(PyPI) | = 0.8.7 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.0 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.1 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.2 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.3 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.4 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.5 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.6 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.7 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.8 | No fix listed |
| pypi dulwich(PyPI) | = 0.9.9 | No fix listed |
| debian/dulwich(Debian:12) | < 0.18.5-1 | 0.18.5-1 |
| debian/dulwich(Debian:13) | < 0.18.5-1 | 0.18.5-1 |
| debian/dulwich(Debian:14) | < 0.18.5-1 | 0.18.5-1 |
| dulwich project dulwich | <= 0.18.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- github.com
- tracker.debian.org issue-tracking third-party-advisory
- web.archive.org
- web.archive.org
- www.dulwich.io product vendor-advisory
- www.dulwich.io issue-tracking patch vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-16228 vendor-advisory