CVE-2017-16228: Critical severity dulwich vulnerability
Published Oct 29, 2017
·Updated
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Affected Software
2 affected componentsFixes available
pip/dulwich<0.18.5
0.18.5
Dulwich Project Dulwich<=0.18.4
Remediation
Event History
Oct 29, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 13, 2022
Advisory Published
01:44 AM
Frequently Asked Questions
1
What is the severity of CVE-2017-16228?
CVE-2017-16228 is classified as a high-severity vulnerability due to its potential for remote command execution.
2
How do I fix CVE-2017-16228?
To fix CVE-2017-16228, upgrade Dulwich to version 0.18.5 or later.
3
What versions of Dulwich are affected by CVE-2017-16228?
Dulwich versions prior to 0.18.5, specifically up to and including 0.18.4, are affected by CVE-2017-16228.
4
Can CVE-2017-16228 be exploited remotely?
Yes, CVE-2017-16228 can be exploited remotely through malicious ssh URLs with specific conditions.
5
What is the vulnerability type of CVE-2017-16228?
CVE-2017-16228 is categorized as a command injection vulnerability.