https://bugzilla.redhat.com/show_bug.cgi?id=1484820
Bug ID: 1484820
Summary: CVE-2017-12976 git-annex: RCE via ssh URL with an
initial dash character in the hostname
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: amaris(a)redhat.com
CC: haskell-devel(a)lists.fedoraproject.org,
mathstuf(a)gmail.com, petersen(a)redhat.com
git-annex before 6.20170818 allows remote attackers to execute
arbitrary commands via an ssh URL with an initial dash character in the
hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related
issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and
CVE-2017-1000117.
Upstream patch:
http://source.git-annex.branchable.com/?p=source.git;a=commit;h=df11e5478...
--
You are receiving this mail because:
You are on the CC list for the bug.