PT-2017-19442 · Canonical · Bazaar

Published 2017-09-10 · Updated 2017-09-10

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Bazaar (affected versions not specified)

Description The issue arises from Bazaar's improper handling of host names in 'bzr+ssh://' URLs. A remote attacker could exploit this to construct a Bazaar repository URL. When accessed, this URL could run arbitrary code with the privileges of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

MGASA-2017-0336

Affected Products

Bazaar

References · 4

• https://osv.dev/vulnerability/MGASA-2017-0336 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0336.html · Security Note
• https://usn.ubuntu.com/usn/usn-3411-1 · Note
• https://bugs.mageia.org/show_bug.cgi?id=21681 · Note