PT-2017-12814 · Joey Hess · Git-Annex

Published 2017-08-20 · Updated 2025-11-14 · CVE-2017-12976

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions git-annex versions prior to 6.20170818

Description The issue allows for command injection via malicious SSH hostname. An attacker could trick a victim into adding a remote repository with a specially crafted URL, such as ssh://-eProxyCommand=evil/blah, potentially leading to arbitrary local code execution. The attacker could also embed the malicious URL in the git-annex branch using initremote and have the victim enable it with enableremote.

Recommendations For versions prior to 6.20170818, update to version 6.20170818 or later to resolve the issue. As a temporary workaround, consider avoiding the use of initremote with SSH remotes and restricting the addition of new remote repositories to trusted sources.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12976

DLA-1144-1

DLA-1495-1

DSA-4010-1

HSEC-2023-0009

Affected Products

Git-Annex

References · 23

• https://osv.dev/vulnerability/HSEC-2023-0009 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12976 · Vendor Advisory
• http://debian.org/security/2017/dsa-4010 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1495-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-12976 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-12976 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-12976 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12976 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4010-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12976 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-12976 · Security Note
• https://github.com/haskell/security-advisories · Note
• http://source.git-annex.branchable.com/?p=source.git;a=commitdiff;h=df11e54788b254efebb4898b474de11ae8d3b471 · Note
• http://source.git-annex.branchable.com/?p=source.git%3Ba=blob%3Bf=doc/bugs/dashed_ssh_hostname_security_hole.mdwn · Note
• https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export · Note