VDB

CVE-2017-17459

CVE-2017-17459 PUBLISHED

http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

EPSS 2.80% · 85.4th percentile

Risk Scores

EPSS Score
2.80%
85.4th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSfossil0, 1:1.33-3, *

Timeline

  • Dec 7, 2017 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Dec 28, 2021 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Feb 28, 2022 EPSS Score
  • Jul 4, 2022 EPSS Score
  • Sep 5, 2022 EPSS Score
  • Nov 7, 2022 EPSS Score
  • Jan 9, 2023 EPSS Score
  • Mar 12, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›