Skip to content
OpenAdvisories
Unscored CVE-2017-12976 EUVD-2017-4494GHSA-jqcx-qqvc-9wx5HSEC-2023-0009

git-annex command injection via malicious SSH hostname

Published Aug 20, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: git-annex Package: git-annex Package: git-annex Ecosystem: Debian Ecosystem: Hackage Ecosystem: Ubuntu

Description

git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 git-annex 6.20170818-1 —
Debian 13 git-annex 6.20170818-1 —
Debian 12 git-annex 6.20170818-1 —
Debian 9 git-annex 6.20170101-1+deb9u1 DSA-4010-1
Debian 8 git-annex 5.20141125+deb8u1 DSA-4010-1, DLA-1495-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 7 git-annex 3.20120629+deb7u1 DLA-1144-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS git-annex No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Hackage git-annex < 6.20170818 6.20170818 HSEC-2023-0009

Advisories 3

References