id: PYSEC-2017-12
details: Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers
  to execute arbitrary commands via an ssh URL with an initial dash character in the
  hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116,
  and CVE-2017-1000117.
affected:
- package:
    name: dulwich
    ecosystem: PyPI
    purl: pkg:pypi/dulwich
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.18.5
  versions:
  - 0.0.1
  - 0.1.0
  - 0.1.1
  - 0.10.0
  - 0.10.1a
  - 0.11.0
  - 0.11.1
  - 0.11.2
  - 0.12.0
  - 0.13.0
  - 0.14.0
  - 0.14.1
  - 0.15.0
  - 0.16.0
  - 0.16.1
  - 0.16.2
  - 0.16.3
  - 0.17.1
  - 0.17.2
  - 0.17.3
  - 0.18.0
  - 0.18.1
  - 0.18.2
  - 0.18.3
  - 0.18.4
  - 0.2.1
  - 0.3.0
  - 0.3.1
  - 0.3.2
  - 0.3.3
  - 0.4.0
  - 0.4.1
  - 0.5.0
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.7.0
  - 0.7.1
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 0.9.0
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 0.9.4
  - 0.9.5
  - 0.9.6
  - 0.9.7
  - 0.9.8
  - 0.9.9
references:
- type: WEB
  url: 
    https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/
- type: WEB
  url: https://www.dulwich.io/code/dulwich/
- type: WEB
  url: https://tracker.debian.org/news/882440
- type: ADVISORY
  url: https://github.com/advisories/GHSA-cwwh-4382-6fwr
aliases:
- CVE-2017-16228
- GHSA-cwwh-4382-6fwr
modified: "2021-07-05T00:01:21.470158Z"
published: "2017-10-29T20:29:00Z"