CVE-2014-9706: Dulwich Arbitrary code execution via commit with directory path starting with .git
(updated )
The build_index_from_tree function in index.py in Dulwich versions 0.9.9 and below allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
References
- git.samba.org/?p=jelmer/dulwich.git;a=commitdiff;h=091638be3c89f46f42c3b1d57dc1504af5729176
- github.com/advisories/GHSA-4j5j-58j7-6c3w
- github.com/jelmer/dulwich/commit/091638be3c89f46f42c3b1d57dc1504af5729176
- github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2015-34.yaml
- lists.launchpad.net/dulwich-users/msg00827.html
- nvd.nist.gov/vuln/detail/CVE-2014-9706
Code Behaviors & Features
Detect and mitigate CVE-2014-9706 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →