SecPod SCAP Repo, a repository of SCAP Content (CVE, CCE, CPE, CWE, OVAL and XCCDF)

Download | Alert*

OVAL

[3.7] bzr: does not strip bzr+ssh SSH options (CVE-2017-14176)

ID: oval:org.secpod.oval:def:1800690	Date: (C)2018-03-29 (M)2022-08-31
Class: PATCH	Family: unix

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname Fixed In Version:¶ bzr 3.0

Platform:

Alpine Linux 3.7

Product:

bzr

Reference:

8298

CVE-2017-14176


30479



423868



248392



909



195452



282