CVE-2017-12836
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to...
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
CVE-2017-12836- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
CVE-2017-12836- Updated
- 2026-11-02
EUVDEUVD-2017-4373 No score
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
EUVD-2017-4373- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gw7c-p8cp-7935
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to...
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
GHSA-gw7c-p8cp-7935- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALPINE-CVE-2017-12836
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
ALPINE-CVE-2017-12836- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2017-12836
CVE-2017-12836 does not affect BellSoft software
- Record
BELL-CVE-2017-12836- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSV
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
CVE-2017-12836- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-12836
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
DEBIAN-CVE-2017-12836- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12836
CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
- Record
UBUNTU-CVE-2017-12836- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0284 No score
Updated cvs package fixes security vulnerability
It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command (CVE-2017-12836).
- Record
MGASA-2017-0284- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10708-1 No score
cvs-1.12.13-1.14 on GA media
These are all security issues fixed in the cvs-1.12.13-1.14 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10708-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2419-1 No score
Security update for cvs
This update for cvs fixes the following issues:
- CVE-2017-12836: A leading dash in the argument of the '-d' option could lead to argument injection (bsc#1053364)
- Record
SUSE-SU-2017:2419-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2422-1 No score
Security update for cvs
This update for cvs fixes the following issues:
- CVE-2017-12836: A leading dash in the argument of the '-d' option could lead to argument injection (bsc#1053364)
- Record
SUSE-SU-2017:2422-1- Updated
- 2026-11-02
OSVUSN-3399-1 No score
cvs vulnerability
Hank Leininger discovered that cvs did not properly handle SSH for remote repositories. A remote attacker could use this to construct a cvs repository that when accessed could run arbitrary code with the privileges of the user.
- Record
USN-3399-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cvsAlpine:v3.10 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.11 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.12 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.13 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.14 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.15 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.16 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.17 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.22 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.23 |
before 1.12.12-r0 | 1.12.12-r0 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cvsAlpine:v3.24 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.8 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsAlpine:v3.9 |
before 1.12.12-r0 | 1.12.12-r0 |
cvsDebian:12 |
before 2:1.12.13+real-24 | 2:1.12.13+real-24 |
cvsDebian:13 |
before 2:1.12.13+real-24 | 2:1.12.13+real-24 |
cvsDebian:14 |
before 2:1.12.13+real-24 | 2:1.12.13+real-24 |
cvsDebian:7 |
before 2:1.12.13+real-9+deb7u1, plus listed versions 2:1.12.13+real-9 |
2:1.12.13+real-9+deb7u1 |
cvsDebian:8 |
before 2:1.12.13+real-15+deb8u1, plus listed versions 2:1.12.13+real-15 |
2:1.12.13+real-15+deb8u1 |
cvsDebian:9 |
before 2:1.12.13+real-22+deb9u1, plus listed versions 2:1.12.13+real-22 |
2:1.12.13+real-22+deb9u1 |
cvsMageia:5 |
before 1.12.13-25.1.mga5 | 1.12.13-25.1.mga5 |
cvsMageia:6 |
before 1.12.13-26.1.mga6 | 1.12.13-26.1.mga6 |
cvsSUSE:Linux Enterprise Desktop 12 SP2 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Desktop 12 SP3 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Server 12 SP2 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Server 12 SP3 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.12.12-182.3.1 | 1.12.12-182.3.1 |
cvsSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.12.12-144.23.5.3.1 | 1.12.12-144.23.5.3.1 |
cvsSUSE:Linux Enterprise Server 11 SP4 |
before 1.12.12-144.23.5.3.1 | 1.12.12-144.23.5.3.1 |
cvsSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.12.12-144.23.5.3.1 | 1.12.12-144.23.5.3.1 |
cvsUbuntu:14.04:LTS |
before 2:1.12.13+real-12ubuntu0.1, plus listed versions 2:1.12.13+real-112:1.12.13+real-12 |
2:1.12.13+real-12ubuntu0.1 |
cvsUbuntu:16.04:LTS |
before 2:1.12.13+real-15ubuntu0.1, plus listed versions 2:1.12.13+real-15 |
2:1.12.13+real-15ubuntu0.1 |
cvsopenSUSE:Tumbleweed |
before 1.12.13-1.14 | 1.12.13-1.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12836 is a high vulnerability (CVSS 7.5) in Gnu Cvs, published August 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.64%, the 93rd percentile. Fixed in cvs 1.12.12-r0.
References
securityfocus.com/bid/100279
openwall.com/lists/oss-security/2017/08/11/4
debian.org/security/2017/dsa-3940
lists.nongnu.org/archive/html/bug-cvs/2017-08/msg00000.html
bugzilla.redhat.com/show_bug.cgi?id=1480800
Show 16 moreShow less
security.gentoo.org/glsa/201709-17
ubuntu.com/usn/USN-3399-1
nvd.nist.gov/vuln/detail/CVE-2017-12836
github.com/advisories/GHSA-gw7c-p8cp-7935
security.alpinelinux.org/vuln/CVE-2017-12836
docs.bell-sw.com/security/cves/CVE-2017-12836
security-tracker.debian.org/tracker/CVE-2017-12836
advisories.mageia.org/MGASA-2017-0284.html
bugs.mageia.org/show_bug.cgi?id=21504
suse.com/support/update/announcement/2017/suse-su-20172419-1
bugzilla.suse.com/1053364
ubuntu.com/security/CVE-2017-12836
cve.org/CVERecord?id=CVE-2017-12836