CVE-2014-9706 — Project Dulwich vulnerability

CWE-199 documents6 sources
Severity
7.5HIGHNVD
EPSS
2.8%
top 13.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dulwich Project DulwichDebian Linux
Timeline
PublishedMar 31
Latest updateMay 17

Description

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶Debiandulwich_project/dulwich< 0.10.1-1+3

Also affects: Debian Linux 7.0

🔴Vulnerability Details

4
OSV
Dulwich Arbitrary code execution via commit with directory path starting with .git↗2022-05-17
▶
GHSA
Dulwich Arbitrary code execution via commit with directory path starting with .git↗2022-05-17
▶
CVEList
CVE-2014-9706: The build_index_from_tree function in index↗2015-03-31
▶
OSV
CVE-2014-9706: The build_index_from_tree function in index↗2015-03-31
▶

📋Vendor Advisories

1
Debian
CVE-2014-9706: dulwich - The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows re...↗2014
▶

💬Community

3
Bugzilla
CVE-2014-9706 python-dulwich: arbitrary files allowed to be commited, leading to code execution [fedora-all]↗2015-03-23
▶
Bugzilla
CVE-2014-9706 python-dulwich: arbitrary files allowed to be commited, leading to code execution↗2015-03-23
▶
Bugzilla
CVE-2014-9706 python-dulwich: arbitrary files allowed to be commited, leading to code execution [epel-all]↗2015-03-23
▶
CVE-2014-9706 — Dulwich Project Dulwich vulnerability | cvebase