VDB

ALPINE-CVE-2017-12836

ALPINE-CVE-2017-12836 PUBLISHED CVSS 7.5 HIGH

CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."

Risk Scores

CVSS v3.0
7.5
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.22cvs1.11.23-r1, 1.11.23-r0, 0
Alpine:v3.13cvs1.11.23-r0, 1.11.23-r1, 1.11.23-r0
Alpine:v3.12cvs0, 1.11.23-r0, 1.11.23-r0
Alpine:v3.14cvs1.11.23-r1, 1.11.23-r0, 0
Alpine:v3.9cvs1.11.23-r1, 0, 1.11.23-r1
Alpine:v3.23cvs1.11.23-r1, 1.11.23-r0, 0
Alpine:v3.17cvs1.11.23-r0, 1.11.23-r1, 1.11.23-r0
Alpine:v3.8cvs1.11.23-r0, 0, 1.11.23-r0
Alpine:v3.16cvs1.11.23-r1, 1.11.23-r0, 0
Alpine:v3.10cvs0, 1.11.23-r1, 1.11.23-r0
Alpine:v3.15cvs0, 1.11.23-r1, 1.11.23-r0
Alpine:v3.11cvs0, 1.11.23-r1, 1.11.23-r0

Timeline

  • Aug 24, 2017 CVE Published
  • Dec 3, 2025 CVE Updated
  • Apr 30, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›