PT-2017-3344 · Joey Hess+2 · Git-Annex+2

Published

2017-08-10

·

Updated

2025-11-14

·

CVE-2017-12836

CVSS v3.1

7.5

High

VectorAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions CVS versions 1.12.x git-annex versions prior to 6.20170818
Description The issue is related to the improper handling of data when interacting with a remote repository over SSH. This could allow a remote attacker to execute arbitrary code by using a specially crafted hostname in the repository URL. For example, a malicious SSH hostname like -oProxyCommand=id;localhost:/bar or ssh://-eProxyCommand=evil/blah could be used to exploit this. The attacker would need to trick the victim into adding a remote repository with such a URL or embedding it in the git-annex branch using initremote.
Recommendations For CVS version 1.12.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For git-annex versions prior to 6.20170818, update to version 6.20170818 or later to resolve the issue. As a temporary workaround, consider avoiding the use of initremote with SSH remotes and restricting the addition of new remote repositories to prevent potential exploitation.

Exploit

Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2018-00109
CVE-2017-12836
DLA-1056-1
DLA-1495-1
DSA-3940-1
HSEC-2023-0009
MGASA-2017-0284
OPENSUSE-SU-2024:10708-1
SUSE-SU-2017:2419-1
SUSE-SU-2017:2422-1
SUSE-SU-2017_2419-1
SUSE-SU-2017_2422-1
USN-3399-1

Affected Products

Suse
Ubuntu
Git-Annex