Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-12836: CVS 1.12 allows remote code execution via crafted SSH URL
CVE-2017-12836 · published 9 years ago
Summary
Versions of CVS 1.12 that use SSH for remote repositories can be tricked into running any command the attacker wants by supplying a specially crafted repository address. This could let an attacker take control of the server running CVS. Upgrade to a patched CVS release or reconfigure CVS to avoid using SSH URLs until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gnu | cvs |
1.12.1 1.12.3 1.12.5 1.12.6 1.12.7 1.12.9 1.12.10 1.12.11 1.12.12 1.12.13 cpe:2.3:a:gnu:cvs:1.12.1:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
14.04 16.04 17.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
Original advisory text
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyComma...
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
References
- http://www.debian.org/security/2017/dsa-3940 Third Party Advisory
- http://lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html Exploit Mailing List Vendor Advisory
- http://www.openwall.com/lists/oss-security/2017/08/11/1 Exploit Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/08/11/4 Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/100279 Third Party Advisory VDB Entry
- http://www.ubuntu.com/usn/USN-3399-1 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1480800 Issue Tracking Patch Third Party Advisory VDB Entry
- https://security.gentoo.org/glsa/201709-17 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published24 Aug 2017
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-12836 · NVD
Track software like this
Free during beta