CVE-2017-9800
CriticalSummary
A maliciously constructed svn+ssh:// URL could cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run arbitrary shell commands. Such a URL could be generated by a malicious server, a malicious user, or a proxy server.
Risk Assessment
This vulnerability could lead to unauthorized command execution on user systems, posing a serious threat to the security of the organization's data and systems.
Recommendation
It is recommended to update Subversion clients to the latest versions to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.