CVE-2017-12976: Input Validation
Published Aug 20, 2017
·Updated
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.
Affected Software
1 affected component
Git-annex Project Git-annex<=6.20170520
Event History
Aug 20, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-12976?
CVE-2017-12976 is classified as a high-severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2017-12976?
To fix CVE-2017-12976, upgrade git-annex to version 6.20170818 or later.
3
What versions of git-annex are affected by CVE-2017-12976?
All versions of git-annex prior to 6.20170818 are affected by CVE-2017-12976.
4
Can CVE-2017-12976 be exploited remotely?
Yes, CVE-2017-12976 can be exploited by remote attackers through specially crafted SSH URLs.
5
What type of attack does CVE-2017-12976 enable?
CVE-2017-12976 enables remote code execution attacks through manipulated SSH connections.