CVE-2017-16228

Critical

Published: 29/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Dulwich before version 0.18.5, when using an SSH subprocess, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname.

Risk Assessment

Attackers could gain access to the system and execute unauthorized commands, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade to Dulwich version 0.18.5 or later to mitigate this vulnerability.

Original NVD description (English source)

Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.