CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-12836

CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."

Exploit prediction scoring system (EPSS) score

EPSS Score 0.044

EPSS Ranking 88.3%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 5.1

References

Products affected by CVE-2017-12836

Gnu » Cvs » Version: 1.12.1

cpe:2.3:a:gnu:cvs:1.12.1
Gnu » Cvs » Version: 1.12.10

cpe:2.3:a:gnu:cvs:1.12.10
Gnu » Cvs » Version: 1.12.11

cpe:2.3:a:gnu:cvs:1.12.11
Gnu » Cvs » Version: 1.12.12

cpe:2.3:a:gnu:cvs:1.12.12
Gnu » Cvs » Version: 1.12.13

cpe:2.3:a:gnu:cvs:1.12.13
Gnu » Cvs » Version: 1.12.3

cpe:2.3:a:gnu:cvs:1.12.3
Gnu » Cvs » Version: 1.12.5

cpe:2.3:a:gnu:cvs:1.12.5
Gnu » Cvs » Version: 1.12.6

cpe:2.3:a:gnu:cvs:1.12.6
Gnu » Cvs » Version: 1.12.7

cpe:2.3:a:gnu:cvs:1.12.7
Gnu » Cvs » Version: 1.12.9

cpe:2.3:a:gnu:cvs:1.12.9
Canonical » Ubuntu Linux » Version: 14.04

cpe:2.3:o:canonical:ubuntu_linux:14.04
Canonical » Ubuntu Linux » Version: 16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04
Canonical » Ubuntu Linux » Version: 17.04

cpe:2.3:o:canonical:ubuntu_linux:17.04
Debian » Debian Linux » Version: 8.0

cpe:2.3:o:debian:debian_linux:8.0
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-12836

Products

Pricing

Contact Us