CVE-2017-14176

Published: Nov 27, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

Affected (6)

Products: Debian: Debian Linux · Canonical: Ubuntu Linux, Bazaar

1 product

2 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.04

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Bazaar	Up to 2.7.0

References (14)

http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.html

Source: security@ubuntu.com

Issue TrackingVendor Advisory

http://www.ubuntu.com/usn/usn-3411-1

Source: security@ubuntu.com

Issue TrackingVendor Advisory

https://bugs.debian.org/874429

Source: security@ubuntu.com

Issue TrackingThird Party Advisory

https://bugs.launchpad.net/bzr/+bug/1710979

Source: security@ubuntu.com

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1486685

Source: security@ubuntu.com

Issue TrackingPatchThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1058214

Source: security@ubuntu.com

Issue TrackingThird Party Advisory

https://www.debian.org/security/2017/dsa-4052

Source: security@ubuntu.com

Issue TrackingThird Party Advisory

http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.html

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

http://www.ubuntu.com/usn/usn-3411-1

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://bugs.debian.org/874429

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://bugs.launchpad.net/bzr/+bug/1710979

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1486685

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1058214

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://www.debian.org/security/2017/dsa-4052

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.