~ / search / GHSA-jjxg-hpm7-g95f

GHSA-jjxg-hpm7-g95f

Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

Source: GitHub Advisory Database (reviewed) High CVE-2017-14176

Packages

EcosystemPackageAffectedFixed in
PyPI bzr <= 2.7.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

References

External links from the advisory. They lead to third-party sites.