Bug 1509303 (CVE-2017-16228) - CVE-2017-16228 python-dulwich: Setting SSH arguments from untrusted URLs allows code execution
Summary: CVE-2017-16228 python-dulwich: Setting SSH arguments from untrusted URLs allo...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-16228
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1509304 1509305
Blocks: 1509317
TreeView+ depends on / blocked
 
Reported: 2017-11-03 13:52 UTC by Adam Mariš
Modified: 2019-09-29 14:24 UTC (History)
14 users (show)

Fixed In Version: python-dulwich 0.18.5
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-11-27 21:08:04 UTC
Embargoed:

Attachments (Terms of Use)

Description Adam Mariš 2017-11-03 13:52:20 UTC 
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.

Upstream patch:

https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
Comment 1 Adam Mariš 2017-11-03 13:52:32 UTC 
Created python-dulwich tracking bugs for this issue:

Affects: epel-all [bug 1509304]
Affects: fedora-all [bug 1509305]
Comment 2 Joshua Padman 2017-11-17 01:21:42 UTC 
OpenStack reno is the package that requires python-dulwich. However, it does not use the vulnerable function within python-dulwich. The functionality used by reno is for manipulating git repositories on disk.
Note You need to log in before you can comment on or make changes to this bug.