Description
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | fossil | 1:2.12.1-1 | — |
| Debian 13 | fossil | 1:2.12.1-1 | — |
| Debian 12 | fossil | 1:2.12.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | fossil | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | fossil | No fix yet | — |
| Ubuntu Pro 16.04 LTS | fossil | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | fossil | 2.12.1-bp152.2.3.1 | openSUSE-SU-2021:1070-1, openSUSE-SU-2020:1478-1 |
| SUSE Package Hub 15 SP1 | fossil | 2.12.1-bp152.2.3.1 | openSUSE-SU-2020:1478-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | fossil | 2.16-1.2 | openSUSE-SU-2024:10764-1 |
| openSUSE Leap 15.2 | fossil | 2.12.1-bp152.2.3.1 | openSUSE-SU-2020:1478-1 |
| openSUSE Leap 15.1 | fossil | 2.12.1-bp152.2.3.1 | openSUSE-SU-2020:1478-1 |
Advisories 3
- openSUSE-SU-2021:1070-1 Security update for fossil SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1478-1 Security update for fossil SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10764-1 fossil-2.16-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://www.openwall.com/lists/oss-security/2020/08/20/1
- https://fossil-scm.org/forum/info/a05ae3ce7760daf6
- [oss-security] 20200825 Re: Fossil-SCM patch fixes RCE in all historic versions mailing-list
- https://fossil-scm.org/fossil/vdiff?branch=sec2020-2.12-patch&diff=1&w
- openSUSE-SU-2020:1478 vendor-advisory
- GLSA-202011-04 vendor-advisory
- FEDORA-2020-50be892d25 vendor-advisory
- FEDORA-2020-ac6cf99f87 vendor-advisory