CVE-2017-14176
- State
- Published
- Severity
- Not scored
- Published
- Nov 27, 2017
- Updated
- Aug 5, 2024
- Reserved
- Sep 7, 2017
Description
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Bazaar through 2.7.0n/a |
|
References
- DSA-4052vendor-advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1058214
- http://www.ubuntu.com/usn/usn-3411-1
- https://bugs.debian.org/874429
- http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.html
- https://bugs.launchpad.net/bzr/+bug/1710979
- https://bugzilla.redhat.com/show_bug.cgi?id=1486685
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.