CVE-2017-12836
24.08.2017, 14:29
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."Enginsight
| Vendor | Product | Version |
|---|---|---|
| gnu | cvs | 1.12.1 |
| gnu | cvs | 1.12.3 |
| gnu | cvs | 1.12.5 |
| gnu | cvs | 1.12.6 |
| gnu | cvs | 1.12.7 |
| gnu | cvs | 1.12.9 |
| gnu | cvs | 1.12.10 |
| gnu | cvs | 1.12.11 |
| gnu | cvs | 1.12.12 |
| gnu | cvs | 1.12.13 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 17.04 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References