CVE-2017-9800
published 2017-08-11CVE-2017-9800: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an…
PriorityP265critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
18.89%
97.0th percentile
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | subversion | <= 1.8.18 | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | >= 0 < 1.9.7-1 | 1.9.7-1 |
| apache | subversion | >= 0 < 1.9.7-1 | 1.9.7-1 |
| apache | subversion | >= 0 < 1.9.7-1 | 1.9.7-1 |
| apache | subversion | >= 0 < 1.9.7-1 | 1.9.7-1 |
| apache | subversion | >= 0 < 1.8.8-1ubuntu3.3 | 1.8.8-1ubuntu3.3 |
| apache | subversion | >= 0 < 1.9.3-2ubuntu1.1 | 1.9.3-2ubuntu1.1 |
| apache_software_foundation | apache_subversion | — | — |
| apache_software_foundation | apache_subversion | — | — |
| apple | xcode_9 | — | — |
| canonical | bazaar | <= 2.7.0 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | breezy | < breezy 3.0.0~bzr6772-1 (bookworm) | breezy 3.0.0~bzr6772-1 (bookworm) |
| debian | bzr | < breezy 3.0.0~bzr6772-1 (bookworm) | breezy 3.0.0~bzr6772-1 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect svn+ssh:// URLs where the hostname begins with a dash character, which is the attack primitive for CVE-2017-9800 — these are passed unsanitised to the SSH client and interpreted as SSH flags. ↗
- →Monitor for svn:externals or svn:sync-from-url properties containing svn+ssh:// URLs with a leading dash in the hostname, as these are the two SVN metadata fields weaponised to deliver the malicious URL to victim clients. ↗
- →The attack vector is not limited to svn:// transport — all Subversion client transports (file://, http://, plain svn://) are affected because the malicious URL is embedded in repository metadata, not the transport itself. ↗
- →Flag Bazaar (bzr) usage of bzr+ssh:// URLs where the hostname starts with a dash — the same SSH option-injection pattern applies to Bazaar's Subprocess SSH backend. ↗
- →Flag git-annex ssh:// URLs with an initial dash in the hostname (e.g. ssh://-eProxyCommand=…) as the same SSH option-injection class of attack. ↗
- →Treat a malicious server, a malicious committer to a shared repository, or a proxy server as equally valid threat actors — all three can inject the malicious svn+ssh URL to attack other clients. ↗
- ·Affected Subversion client versions are 1.0.0–1.8.18, 1.9.0–1.9.6, and 1.10.0-alpha1–1.10.0-alpha3; versions 1.8.19, 1.9.7+, and later 1.10.x are patched. ↗
- ·Bazaar is only vulnerable when the Subprocess SSH backend is in use; other SSH backends may not be affected. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_apache9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Install, config, upgrade (Apache HTTP Server) — CVE-2017-9800
vendor_oracle·2020-10-15·CVSS 9.8
CVE-2017-9800 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Install, config, upgrade (Apache HTTP Server) — CVE-2017-9800
Oracle Oracle Fusion Middleware Risk Matrix: Install, config, upgrade (Apache HTTP Server) vulnerability
CVE: CVE-2017-9800
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Red Hat
python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
vendor_redhat·2017-10-29·CVSS 9.8
CVE-2017-16228 [CRITICAL] CWE-20 python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Package: python-dulwich (Red Hat OpenStack Platform 11 (Ocata)) - Will not fix
Ubuntu
Subversion vulnerabilities
vendor_ubuntu·2017-10-24·CVSS 6.8
CVE-2016-2167 [MEDIUM] Subversion vulnerabilities
Title: Subversion vulnerabilities
Summary: Several security issues were fixed in Subversion.
USN-3388-1 fixed several vulnerabilities in Subversion. This update
provides the corresponding update for Ubuntu 12.04 ESM.
Ivan Zhakov discovered that Subversion did not properly handle
some requests. A remote attacker could use this to cause a
denial of service. (CVE-2016-2168)
Original advisory details:
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
Apple
CVE-2017-9800: Xcode 9
vendor_apple·2017-09-19·CVSS 9.8
CVE-2017-9800 [CRITICAL] CVE-2017-9800: Xcode 9
Apple Security Update: About the security content of Xcode 9
Product: Xcode 9
CVE: CVE-2017-9800
Component: CVE-2017-9800
Red Hat
bzr: does not strip bzr+ssh SSH options
vendor_redhat·2017-08-26·CVSS 9.8
CVE-2017-14176 [CRITICAL] CWE-77 bzr: does not strip bzr+ssh SSH options
bzr: does not strip bzr+ssh SSH options
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Package: bzr (Red Hat Enterprise Linux 6) - Will not fix
Package: bzr (Red Hat Enterprise Linux 7) - Will not fix
Ubuntu
Subversion vulnerabilities
vendor_ubuntu·2017-08-11·CVSS 6.8
CVE-2016-2167 [MEDIUM] Subversion vulnerabilities
Title: Subversion vulnerabilities
Summary: Several security issues were fixed in Subversion.
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
remote attacker could use this to possibly bypass intended access
restrictions. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2016-2167)
Florian Weimer discovered that Subversion clients did not properly
restrict XML entity expansion when accessing http(s):// URLs. A remote
attacker cou
Red Hat
subversion: Command injection through clients via malicious svn+ssh URLs
vendor_redhat·2017-08-10·CVSS 9.8
CVE-2017-9800 [CRITICAL] CWE-20 subversion: Command injection through clients via malicious svn+ssh URLs
subversion: Command injection through clients via malicious svn+ssh URLs
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
A shell command injection flaw related to the handling of "svn+ssh" URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for example when performi
Debian
CVE-2017-16228: dulwich - Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers t...
vendor_debian·2017·CVSS 9.8
CVE-2017-16228 [CRITICAL] CVE-2017-16228: dulwich - Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers t...
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Scope: local
bookworm: resolved (fixed in 0.18.5-1)
bullseye: resolved (fixed in 0.18.5-1)
forky: resolved (fixed in 0.18.5-1)
sid: resolved (fixed in 0.18.5-1)
trixie: resolved (fixed in 0.18.5-1)
Debian
CVE-2017-14176: breezy - Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to ex...
vendor_debian·2017·CVSS 9.8
CVE-2017-14176 [CRITICAL] CVE-2017-14176: breezy - Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to ex...
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Scope: local
bookworm: resolved (fixed in 3.0.0~bzr6772-1)
bullseye: resolved (fixed in 3.0.0~bzr6772-1)
forky: resolved (fixed in 3.0.0~bzr6772-1)
sid: resolved (fixed in 3.0.0~bzr6772-1)
trixie: resolved (fixed in 3.0.0~bzr6772-1)
Debian
CVE-2017-9800: subversion - A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1...
vendor_debian·2017·CVSS 9.8
CVE-2017-9800 [CRITICAL] CVE-2017-9800: subversion - A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1...
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Scope: local
bookworm: resolved (fixed in 1.9.7-1)
bullseye: resolved (fixed in 1.9.7-1)
forky: resolved (fixed in 1.9.7-1)
sid: resolved (fixed in 1.9.7-1)
trixie: resolved (fixed in 1.9.7-1)
Debian
CVE-2017-17459: fossil - http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allow...
vendor_debian·2017·CVSS 9.8
CVE-2017-17459 [CRITICAL] CVE-2017-17459: fossil - http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allow...
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Scope: local
bookworm: resolved (fixed in 1:2.4-1)
bullseye: resolved (fixed in 1:2.4-1)
sid: resolved (fixed in 1:2.4-1)
trixie: resolved (fixed in 1:2.4-1)
Debian
CVE-2017-12976: git-annex - git-annex before 6.20170818 allows remote attackers to execute arbitrary command...
vendor_debian·2017·CVSS 9.8
CVE-2017-12976 [CRITICAL] CVE-2017-12976: git-annex - git-annex before 6.20170818 allows remote attackers to execute arbitrary command...
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.
Scope: local
bookworm: resolved (fixed in 6.20170818-1)
bullseye: resolved (fixed in 6.20170818-1)
forky: resolved (fixed in 6.20170818-1)
sid: resolved (fixed in 6.20170818-1)
trixie: resolved (fixed in 6.20170818-1)
Apache
Apache subversion: CVE-2017-9800
vendor_apache·CVSS 9.8
CVE-2017-9800 [CRITICAL] Apache subversion: CVE-2017-9800
Apache subversion: CVE-2017-9800
-advisory.txt [ PGP ] 1.0.0-1.8.18 and 1.9.0-1.9.6 and 1.10.0-alpha1-1.10.0-alpha3 Arbitrary code execution on clients through malicious svn+ssh URLs in svn:externals and svn:sync-from-url
GHSA
GHSA-jqcx-qqvc-9wx5: git-annex before 6
ghsa_unreviewed·2022-05-14·CVSS 9.8
CVE-2017-12976 [CRITICAL] CWE-20 GHSA-jqcx-qqvc-9wx5: git-annex before 6
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.
GHSA
GHSA-jjxg-hpm7-g95f: Bazaar through 2
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2017-14176 [CRITICAL] GHSA-jjxg-hpm7-g95f: Bazaar through 2
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
GHSA
GHSA-34wf-vr8w-7xh4: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1
ghsa_unreviewed·2022-05-13
CVE-2017-9800 [CRITICAL] CWE-20 GHSA-34wf-vr8w-7xh4: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
GHSA
GHSA-ff3p-f5xw-q723: http_transport
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2017-17459 [CRITICAL] GHSA-ff3p-f5xw-q723: http_transport
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
OSV
Dulwich RCE Vulnerability
osv·2022-05-13·CVSS 9.8
CVE-2017-16228 [CRITICAL] Dulwich RCE Vulnerability
Dulwich RCE Vulnerability
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
GHSA
Dulwich RCE Vulnerability
ghsa·2022-05-13·CVSS 9.8
CVE-2017-16228 [CRITICAL] Dulwich RCE Vulnerability
Dulwich RCE Vulnerability
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
GHSA
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
ghsa·2022-05-13·CVSS 9.8
CVE-2017-14176 [CRITICAL] Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-17459: http_transport
osv·2017-12-07·CVSS 9.8
CVE-2017-17459 [CRITICAL] CVE-2017-17459: http_transport
http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-14176: Bazaar through 2
osv·2017-11-27·CVSS 9.8
CVE-2017-14176 [CRITICAL] CVE-2017-14176: Bazaar through 2
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-16228: Dulwich before 0
osv·2017-10-29·CVSS 9.8
CVE-2017-16228 [CRITICAL] CVE-2017-16228: Dulwich before 0
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-12976: git-annex before 6
osv·2017-08-20·CVSS 9.8
CVE-2017-12976 [CRITICAL] CVE-2017-12976: git-annex before 6
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.
OSV
CVE-2017-9800: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1
osv·2017-08-11·CVSS 9.8
CVE-2017-9800 [CRITICAL] CVE-2017-9800: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
OSV
subversion vulnerabilities
osv·2017-08-11·CVSS 6.8
CVE-2017-9800 [MEDIUM] subversion vulnerabilities
subversion vulnerabilities
Joern Schneeweisz discovered that Subversion did not properly handle
host names in 'svn+ssh://' URLs. A remote attacker could use this
to construct a subversion repository that when accessed could run
arbitrary code with the privileges of the user. (CVE-2017-9800)
Daniel Shahaf and James McCoy discovered that Subversion did not
properly verify realms when using Cyrus SASL authentication. A
remote attacker could use this to possibly bypass intended access
restrictions. This issue only affected Ubuntu 14.04 LTS and Ubuntu
16.04 LTS. (CVE-2016-2167)
Florian Weimer discovered that Subversion clients did not properly
restrict XML entity expansion when accessing http(s):// URLs. A remote
attacker could use this to cause a denial of service. This issue only
affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-16228 python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
bugzilla·2017-11-03·CVSS 9.8
CVE-2017-16228 [CRITICAL] CVE-2017-16228 python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
CVE-2017-16228 python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Upstream patch:
https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
Discussion:
Created python-dulwich tracking bugs for this issue:
Affects: epel-all [bug 1509304]
Affects: fedora-all [bug 1509305]
---
OpenStack reno is the package that requires python-dulwich. However, it does not use the vulnerable function within python-dulwich. The functionality used by reno is for manipulating
HackerOne
RCE via ssh:// URIs in multiple VCS
hackerone·2017-09-21·CVSS 9.8
CVE-2017-9800 [CRITICAL] RCE via ssh:// URIs in multiple VCS
RCE via ssh:// URIs in multiple VCS
I'd like to submit an RCE issue within Git SVN and Mercurial, the CVEs are:
* CVE-2017-9800 (Subversion)
* CVE-2017-1000116 (Mercurial (hg))
* CVE-2017-1000117 (Git)
Further Info can be found at:
http://blog.recurity-labs.com/2017-08-10/scm-vulns
And product specific:
* https://public-inbox.org/git/[email protected]/T/#u
* http://subversion.apache.org/security/CVE-2017-9800-advisory.txt
* https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/
I think these issues which all are based on the same flaw could be worth
an IBB Bounty. However I'd like to point out that we at Recurity Labs
would like the bounty being donated to a charity. The to be determined
charity will be something in the field of brain aneurysm,
Bugzilla
CVE-2017-12976 git-annex: RCE via ssh URL with an initial dash character in the hostname
bugzilla·2017-08-24·CVSS 9.8
CVE-2017-12976 [CRITICAL] CVE-2017-12976 git-annex: RCE via ssh URL with an initial dash character in the hostname
CVE-2017-12976 git-annex: RCE via ssh URL with an initial dash character in the hostname
git-annex before 6.20170818 allows remote attackers to execute
arbitrary commands via an ssh URL with an initial dash character in the
hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related
issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and
CVE-2017-1000117.
Upstream patch:
http://source.git-annex.branchable.com/?p=source.git;a=commit;h=df11e54788b254efebb4898b474de11ae8d3b471
Discussion:
Created git-annex tracking bugs for this issue:
Affects: epel-all [bug 1484822]
Affects: fedora-all [bug 1484821]
---
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the d
Bugzilla
CVE-2017-9800 subversion: Arbitrary code execution on clients through malicious svn+ssh URLs [fedora-all]
bugzilla·2017-08-10·CVSS 9.8
CVE-2017-9800 [CRITICAL] CVE-2017-9800 subversion: Arbitrary code execution on clients through malicious svn+ssh URLs [fedora-all]
CVE-2017-9800 subversion: Arbitrary code execution on clients through malicious svn+ssh URLs [fedora-all]
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
# bugfix, security, enhancement, newpackage (required)
type=security
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=1479686
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users
Bugzilla
CVE-2017-9800 subversion: Command injection through clients via malicious svn+ssh URLs
bugzilla·2017-08-09·CVSS 9.8
CVE-2017-9800 [CRITICAL] CVE-2017-9800 subversion: Command injection through clients via malicious svn+ssh URLs
CVE-2017-9800 subversion: Command injection through clients via malicious svn+ssh URLs
A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL argument.
A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.
The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Discussion:
Acknowledgmen
http://packetstormsecurity.com/files/143722/Apache-Subversion-Arbitrary-Code-Execution.htmlhttp://www.debian.org/security/2017/dsa-3932http://www.securityfocus.com/archive/1/540999/100/0/threadedhttp://www.securityfocus.com/bid/100259http://www.securitytracker.com/id/1039127https://access.redhat.com/errata/RHSA-2017:2480https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-933099891.htmlhttps://lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0d03b63%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c70398ff76%40%3Ccommits.subversion.apache.org%3Ehttps://security.gentoo.org/glsa/201709-09https://subversion.apache.org/security/CVE-2017-9800-advisory.txthttps://support.apple.com/HT208103https://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://packetstormsecurity.com/files/143722/Apache-Subversion-Arbitrary-Code-Execution.htmlhttp://www.debian.org/security/2017/dsa-3932http://www.securityfocus.com/archive/1/540999/100/0/threadedhttp://www.securityfocus.com/bid/100259http://www.securitytracker.com/id/1039127https://access.redhat.com/errata/RHSA-2017:2480https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-933099891.htmlhttps://lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0d03b63%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c70398ff76%40%3Ccommits.subversion.apache.org%3Ehttps://security.gentoo.org/glsa/201709-09https://subversion.apache.org/security/CVE-2017-9800-advisory.txthttps://support.apple.com/HT208103https://www.oracle.com/security-alerts/cpuoct2020.html
2017-08-11
Published