Vulnerabilities > CVE-2017-16228 - Unspecified vulnerability in Dulwich Project Dulwich

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

dulwich-project

critical

nessus

NVD

Published: 2017-10-29

Updated: 2024-11-21

Summary

Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.

Vulnerable Configurations

Part	Description	Count
Application	Dulwich_Project Dulwich Project Dulwich 0.1.0 Dulwich Project Dulwich 0.1.1 Dulwich Project Dulwich 0.2.0 Dulwich Project Dulwich 0.2.1 Dulwich Project Dulwich 0.3.0 Dulwich Project Dulwich 0.3.1 Dulwich Project Dulwich 0.3.2 Dulwich Project Dulwich 0.3.3 Dulwich Project Dulwich 0.4.0 Dulwich Project Dulwich 0.4.1 Dulwich Project Dulwich 0.5.0 Dulwich Project Dulwich 0.6.0 Dulwich Project Dulwich 0.6.1 Dulwich Project Dulwich 0.6.2 Dulwich Project Dulwich 0.7.0 Dulwich Project Dulwich 0.7.1 Dulwich Project Dulwich 0.8.0 Dulwich Project Dulwich 0.8.1 Dulwich Project Dulwich 0.8.2 Dulwich Project Dulwich 0.8.3 Dulwich Project Dulwich 0.8.4 Dulwich Project Dulwich 0.8.5 Dulwich Project Dulwich 0.8.6 Dulwich Project Dulwich 0.8.7 Dulwich Project Dulwich 0.9.0 Dulwich Project Dulwich 0.9.1 Dulwich Project Dulwich 0.9.2 Dulwich Project Dulwich 0.9.3 Dulwich Project Dulwich 0.9.4 Dulwich Project Dulwich 0.9.5 Dulwich Project Dulwich 0.9.6 Dulwich Project Dulwich 0.9.7 Dulwich Project Dulwich 0.9.8 Dulwich Project Dulwich 0.9.9 Dulwich Project Dulwich 0.9.10 Dulwich Project Dulwich 0.10.0 Dulwich Project Dulwich 0.10.1 Dulwich Project Dulwich 0.11.0 Dulwich Project Dulwich 0.11.1 Dulwich Project Dulwich 0.12.0 Dulwich Project Dulwich 0.13.0 Dulwich Project Dulwich 0.14.0 Dulwich Project Dulwich 0.14.1 Dulwich Project Dulwich 0.15.0 Dulwich Project Dulwich 0.16.0 Dulwich Project Dulwich 0.16.1 Dulwich Project Dulwich 0.16.2 Dulwich Project Dulwich 0.16.3 Dulwich Project Dulwich 0.17.0 Dulwich Project Dulwich 0.17.1 Dulwich Project Dulwich 0.17.2 Dulwich Project Dulwich 0.17.3 Dulwich Project Dulwich 0.18.0 Dulwich Project Dulwich 0.18.1 Dulwich Project Dulwich 0.18.2 Dulwich Project Dulwich 0.18.3 Dulwich Project Dulwich 0.18.4	57

Nessus

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2018-801.NASL
description	This update for python-dulwich to version 0.18.5 fixes this security issue : - CVE-2017-16228: Dulwich, when an SSH subprocess is used, allowed remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname (bsc#1066430). For detailed changes please see https://www.dulwich.io/code/dulwich/ This update was imported from the SUSE:SLE-12:Update update project.
last seen	2020-06-05
modified	2018-08-07
plugin id	111563
published	2018-08-07
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/111563
title	openSUSE Security Update : python-dulwich (openSUSE-2018-801)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2017-5DD9B12179.NASL
description	Update to 0.18.6 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-05
modified	2018-01-15
plugin id	105887
published	2018-01-15
reporter	This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/105887
title	Fedora 27 : python-dulwich (2017-5dd9b12179)

Summary

Vulnerable Configurations

Nessus

References