Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 635856 (CVE-2017-16228) - <dev-python/dulwich-0.18.5: SSH subprocess allows remote attackers to execute arbitrary commands via ssh URL
Summary: <dev-python/dulwich-0.18.5: SSH subprocess allows remote attackers to execute...
Status: RESOLVED FIXED
Alias: CVE-2017-16228
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-10-30 00:41 UTC by Aleksandr Wagner (Kivak)
Modified: 2018-01-19 20:11 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Aleksandr Wagner (Kivak) 2017-10-30 00:41:52 UTC 
CVE-2017-16228 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16228):

Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117. 

References:

https://tracker.debian.org/news/882440
https://www.dulwich.io/code/dulwich/
https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
Comment 1 Fabian Groffen gentoo-dev 2017-10-30 10:23:44 UTC 
dulwich-0.18.5 is in the tree now.
Comment 2 Aleksandr Wagner (Kivak) 2017-10-30 16:04:15 UTC 
@ Maintainer(s): Thank you, please state when you are ready for stabilization.
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2018-01-19 20:11:11 UTC 
Package is stable and tree is clean.