Every CVE Search/ Get API key

CVE-2014-9706

Dulwich Arbitrary code execution via commit with directory path starting with .git

7.5 HighFix available

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Exploit likelihood

5.00%Down 2.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
CVE-2014-9706
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-19
Updated
2026-11-02
CVE List No score

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
CVE-2014-9706
Updated
2026-11-02
EUVDEUVD-2015-0019 No score

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
EUVD-2015-0019
Updated
2026-11-03
GitHub AdvisoriesGHSA-4j5j-58j7-6c3w 9.3

Dulwich Arbitrary code execution via commit with directory path starting with .git

The build_index_from_tree function in index.py in Dulwich versions 0.9.9 and below allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
GHSA-4j5j-58j7-6c3w
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-4j5j-58j7-6c3w 9.3

Dulwich Arbitrary code execution via commit with directory path starting with .git

The build_index_from_tree function in index.py in Dulwich versions 0.9.9 and below allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
GHSA-4j5j-58j7-6c3w
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV No score

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
CVE-2014-9706
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9706 No score

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
DEBIAN-CVE-2014-9706
Updated
2026-11-02
OSVMGASA-2015-0157 No score

Updated python-dulwich packages fix security vulnerabilities

Updated python-dulwich package fixes security vulnerabilities:

It was discovered that Dulwich allows writing to files under .git/ when checking out working trees. This could lead to the execution of arbitrary code with the privileges of the user running an application based on Dulwich (CVE-2014-9706).

Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function, used when accessing Git objects in pack files. An attacker could take advantage of this flaw to cause the execution of arbitrary code with the privileges of the user running a Git server or client based on Dulwich (CVE-2015-0838).

The python-dulwich package has been updated to version 0.10.0, fixing these issues and other bugs.

Record
MGASA-2015-0157
Updated
2026-11-02
OSVPYSEC-2015-34 No score

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Record
PYSEC-2015-34
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dulwich
PyPI
 before 0.9.10
0.9.10
dulwich
Debian:12
 before 0.10.1-1
0.10.1-1
dulwich
Debian:13
 before 0.10.1-1
0.10.1-1
dulwich
Debian:14
 before 0.10.1-1
0.10.1-1
dulwich
Debian:7
From an advisory covering 2 CVEs
 before 0.8.5-2+deb7u2, plus listed versions
0.8.5-20.8.5-2+deb7u1
0.8.5-2+deb7u2
dulwich
PyPI
 before 0.9.10, plus listed versions
0.0.10.1.00.1.10.2.10.3.0
Show 29 moreShow less
0.3.10.3.20.3.30.4.00.4.10.5.00.6.00.6.10.6.20.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.8.60.8.70.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.9.9
0.9.10
python-dulwich
Mageia:4
From an advisory covering 2 CVEs
 before 0.10.0-1.mga4
0.10.0-1.mga4
dulwich
PyPI
 before 0.9.9, plus listed versions
0.0.10.1.00.1.10.2.10.3.0
Show 28 moreShow less
0.3.10.3.20.3.30.4.00.4.10.5.00.6.00.6.10.6.20.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.8.60.8.70.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.8
0.9.9

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9706 is a high vulnerability (CVSS 7.5) in Dulwich Project Dulwich, published March 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.00%, the 92nd percentile. Fixed in dulwich 0.9.10.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open