CVE-2017-14176
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
CVE-2017-14176 is a high vulnerability (CVSS 8.8) in Canonical Bazaar, published September 5, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.27%, the 93rd percentile. Fixed in breezy 3.0.0~bzr6772-1.
- Severity
- 8.8 HighCVSS 3.0, NVD
- Exploit chance
- 6.27%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.0.0~bzr6772-1breezy +13 more
Description
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
bzrPyPI | through 2.7.0 | None known |
breezyDebian:12 | before 3.0.0~bzr6772-1 | 3.0.0~bzr6772-1 |
breezyDebian:13 | before 3.0.0~bzr6772-1 | 3.0.0~bzr6772-1 |
breezyDebian:14 | before 3.0.0~bzr6772-1 | 3.0.0~bzr6772-1 |
bzrDebian:12 | before 2.7.0+bzr6622-7 | 2.7.0+bzr6622-7 |
bzrDebian:13 | before 2.7.0+bzr6622-7 | 2.7.0+bzr6622-7 |
bzrDebian:7 From an advisory covering 2 CVEs | before 2.6.0~bzr6526-1+deb7u1, plus listed versions 2.6.0~bzr6526-1 | 2.6.0~bzr6526-1+deb7u1 |
bzrDebian:8 | before 2.6.0+bzr6595-6+deb8u1, plus listed versions 2.6.0+bzr6595-6 | 2.6.0+bzr6595-6+deb8u1 |
bzrDebian:9 | before 2.7.0+bzr6619-7+deb9u1, plus listed versions 2.7.0+bzr6619-7 | 2.7.0+bzr6619-7+deb9u1 |
bzrPyPI | through 2.7.0, plus listed versions 2.6.0 | None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bzrPyPI | Not stated | Not evaluated |
bzrSUSE:Linux Enterprise Software Development Kit 11 SP4 | before 1.8-3.5.1 | 1.8-3.5.1 |
bzrUbuntu:14.04:LTS | before 2.6.0+bzr6593-1ubuntu1.6, plus listed versions 2.6.0-3ubuntu12.6.0-3ubuntu22.6.0+bzr6591-1ubuntu12.6.0+bzr6593-1ubuntu12.6.0+bzr6593-1ubuntu1.12.6.0+bzr6593-1ubuntu1.5 | 2.6.0+bzr6593-1ubuntu1.6 |
bzrUbuntu:16.04:LTS | before 2.7.0-2ubuntu3.1, plus listed versions 2.6.0+bzr6602-2ubuntu42.6.0+bzr6606-2ubuntu12.7.0-2ubuntu12.7.0-2ubuntu22.7.0-2ubuntu3 | 2.7.0-2ubuntu3.1 |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
What each source reports
NVD Score used
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
CVE-2017-14176- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
CVE-2017-14176- Updated
- 2026-11-02
EUVDEUVD-2017-5686No score
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
EUVD-2017-5686- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jjxg-hpm7-g95f
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
GHSA-jjxg-hpm7-g95f- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
CVE-2017-14176- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-14176
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
DEBIAN-CVE-2017-14176- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-jjxg-hpm7-g95f
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
GHSA-jjxg-hpm7-g95f- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2017-149
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
PYSEC-2017-149- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-14176
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
- Record
UBUNTU-CVE-2017-14176- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2018:1489-1No score
Security update for bzr
Bzr was updated to fix a security issue:
- CVE-2017-14176: Avoid code execution using ssh:// url injection (boo#1058214)
- Record
SUSE-SU-2018:1489-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
debian.org/security/2017/dsa-4052
bugzilla.suse.com/show_bug.cgi?id=1058214
ubuntu.com/usn/usn-3411-1
bugs.debian.org/874429
people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.html
bugs.launchpad.net/bzr/+bug/1710979
Show 12 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1486685
nvd.nist.gov/vuln/detail/CVE-2017-14176
github.com/pypa/advisory-database/tree/main/vulns/bzr/PYSEC-2017-149.yaml
security-tracker.debian.org/tracker/CVE-2017-14176
suse.com/support/update/announcement/2018/suse-su-20181489-1
ubuntu.com/security/CVE-2017-14176
cve.org/CVERecord?id=CVE-2017-14176