CVE-2017-12836 PUBLISHED

CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."

EPSS 4.41% · 88.9th percentile

Risk Scores

EPSS Score
4.41%
88.9th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTScvs0, 2:1.12.13+real-11, 2:1.12.13+real-12
Ubuntu:16.04:LTScvs0, 2:1.12.13+real-15

Timeline

References

Open in Interactive Console →