CVE-2017-14176
published 2017-11-27CVE-2017-14176: Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in…
PriorityP354high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
6.24%
93.5th percentile
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | bazaar | <= 2.7.0 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | breezy | < breezy 3.0.0~bzr6772-1 (bookworm) | breezy 3.0.0~bzr6772-1 (bookworm) |
| debian | bzr | < breezy 3.0.0~bzr6772-1 (bookworm) | breezy 3.0.0~bzr6772-1 (bookworm) |
| debian | bzr | 0 – 2.7.0 | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | fossil | < fossil 1:2.4-1 (bookworm) | fossil 1:2.4-1 (bookworm) |
| fossil-scm | fossil | >= 0 < 1:2.4-1 | 1:2.4-1 |
| fossil-scm | fossil | >= 0 < 1:2.4-1 | 1:2.4-1 |
| fossil-scm | fossil | >= 0 < 1:2.4-1 | 1:2.4-1 |
| fossil_scm | fossil | < 2.4 | 2.4 |
| msrc | cm1_bzr_2.7.0_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jjxg-hpm7-g95f: Bazaar through 2
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2017-14176 [CRITICAL] GHSA-jjxg-hpm7-g95f: Bazaar through 2
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
GHSA
GHSA-ff3p-f5xw-q723: http_transport
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2017-17459 [CRITICAL] GHSA-ff3p-f5xw-q723: http_transport
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
GHSA
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
ghsa·2022-05-13·CVSS 9.8
CVE-2017-14176 [CRITICAL] Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-17459: http_transport
osv·2017-12-07·CVSS 9.8
CVE-2017-17459 [CRITICAL] CVE-2017-17459: http_transport
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-14176: Bazaar through 2
osv·2017-11-27·CVSS 9.8
CVE-2017-14176 [CRITICAL] CVE-2017-14176: Bazaar through 2
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Microsoft
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands
vendor_msrc·2017-11-14·CVSS 8.8
CVE-2017-14176 [HIGH] Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
canonical: canonical
Customer Action Required: Yes
Re
Ubuntu
Bazaar vulnerability
vendor_ubuntu·2017-10-24
CVE-2017-14176 Bazaar vulnerability
Title: Bazaar vulnerability
Summary: Bazaar could be made run programs as your login if it opened a
specially crafted URL.
USN-3411-1 fixed a vulnerability in Bazaar. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Original advisory details:
Adam Collard discovered that Bazaar did not properly handle host names
in 'bzr+ssh://' URLs. A remote attacker could use this to construct
a bazaar repository URL that when accessed could run arbitrary code
with the privileges of the user.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
bzr: does not strip bzr+ssh SSH options
vendor_redhat·2017-08-26·CVSS 9.8
CVE-2017-14176 [CRITICAL] CWE-77 bzr: does not strip bzr+ssh SSH options
bzr: does not strip bzr+ssh SSH options
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: bzr (Red Hat Enterprise Linux 6) - Will not fix
Package: bzr (Red Hat Enterprise Linux 7) - Will not fix
Debian
CVE-2017-14176: breezy - Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to ex...
vendor_debian·2017·CVSS 9.8
CVE-2017-14176 [CRITICAL] CVE-2017-14176: breezy - Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to ex...
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Scope: local
bookworm: resolved (fixed in 3.0.0~bzr6772-1)
bullseye: resolved (fixed in 3.0.0~bzr6772-1)
forky: resolved (fixed in 3.0.0~bzr6772-1)
sid: resolved (fixed in 3.0.0~bzr6772-1)
trixie: resolved (fixed in 3.0.0~bzr6772-1)
Debian
CVE-2017-17459: fossil - http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allow...
vendor_debian·2017·CVSS 9.8
CVE-2017-17459 [CRITICAL] CVE-2017-17459: fossil - http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allow...
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Scope: local
bookworm: resolved (fixed in 1:2.4-1)
bullseye: resolved (fixed in 1:2.4-1)
sid: resolved (fixed in 1:2.4-1)
trixie: resolved (fixed in 1:2.4-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-14176 bzr: does not strip bzr+ssh SSH options
bugzilla·2017-08-30·CVSS 8.8
CVE-2017-14176 [HIGH] CVE-2017-14176 bzr: does not strip bzr+ssh SSH options
CVE-2017-14176 bzr: does not strip bzr+ssh SSH options
It was discovered that the bzr did not properly filter bzr+ssh: URLs, which can be exploited to inject commands via malicious URLs.
Upstream bug:
https://bugs.launchpad.net/bzr/+bug/1710979
Patch:
http://bazaar.launchpad.net/~brz/brz/trunk/revision/6754
Discussion:
Created bzr tracking bugs for this issue:
Affects: fedora-all [bug 1486686]
---
Statement:
Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Bugzilla
CVE-2017-14176 bzr: does not strip bzr+ssh SSH options [fedora-all]
bugzilla·2017-08-30·CVSS 8.8
CVE-2017-14176 [HIGH] CVE-2017-14176 bzr: does not strip bzr+ssh SSH options [fedora-all]
CVE-2017-14176 bzr: does not strip bzr+ssh SSH options [fedora-all]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1486685
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=F
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.htmlhttp://www.ubuntu.com/usn/usn-3411-1https://bugs.debian.org/874429https://bugs.launchpad.net/bzr/+bug/1710979https://bugzilla.redhat.com/show_bug.cgi?id=1486685https://bugzilla.suse.com/show_bug.cgi?id=1058214https://www.debian.org/security/2017/dsa-4052http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.htmlhttp://www.ubuntu.com/usn/usn-3411-1https://bugs.debian.org/874429https://bugs.launchpad.net/bzr/+bug/1710979https://bugzilla.redhat.com/show_bug.cgi?id=1486685https://bugzilla.suse.com/show_bug.cgi?id=1058214https://www.debian.org/security/2017/dsa-4052
2017-11-27
Published