CVE-2017-16228: Dulwich RCE Vulnerability
(updated )
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
References
- github.com/advisories/GHSA-cwwh-4382-6fwr
- github.com/jelmer/dulwich
- github.com/jelmer/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6
- github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2017-12.yaml
- nvd.nist.gov/vuln/detail/CVE-2017-16228
- tracker.debian.org/news/882440
- web.archive.org/web/20201220231743/https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6
- web.archive.org/web/20210128154006/https://www.dulwich.io/code/dulwich
- www.dulwich.io/code/dulwich
- www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6
Code Behaviors & Features
Detect and mitigate CVE-2017-16228 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →