CVE-2017-16228 Dulwich RCE Vulnerability
Remote attackers can execute arbitrary commands via crafted SSH URLs in Dulwich when SSH subprocesses are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-16228?
CVE-2017-16228 is a critical command injection vulnerability in n/a, published on 29 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Which versions are affected by CVE-2017-16228?
3 open source packages ship an affected version, including dulwich. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dulwich PyPI | All versions | 0.18.5 |
dulwich PyPI | All versions | 0.18.5 |
dulwich PyPI | All versions | 0.18.5 |
Linux distribution packages (1)
python-dulwich SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 0.18.5-4.3.1 |
Products include Dulwich Project Dulwich.
How do I fix CVE-2017-16228?
Upgrade dulwich to 0.18.5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-16228 being exploited?
There is no known exploitation of CVE-2017-16228 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2017-16228, GHSA-cwwh-4382-6fwr, MGASA-2018-0445, PYSEC-2017-12, SUSE-SU-2018:2047-1, UBUNTU-CVE-2017-16228.