dulwich project vulnerabilities

Products

• dulwich 3

Latest dulwich project CVEs

Newest publication first

1. CVE-2017-16228 Dulwich RCE Vulnerability

   Published 2017-10-29

   Critical·CVSS 9.8 EPSS 3.8%

   Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.

2. CVE-2015-0838 Dulwich Buffer Overflow when handling pack files

   Published 2015-03-31

   High·CVSS 7.5 EPSS 3.4%

   Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

3. CVE-2014-9706 Dulwich Arbitrary code execution via commit with directory path starting with .git

   Published 2015-03-31

   High·CVSS 7.5 EPSS 5.0%

   The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.