{"id":"CVE-2014-9706","aliases":["DEBIAN-CVE-2014-9706","DSA-3206-1","EUVD-2015-0019","GHSA-4j5j-58j7-6c3w","MGASA-2015-0157","PYSEC-2015-34"],"status":"published","title":"Dulwich Arbitrary code execution via commit with directory path starting with .git","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04996,"percentile":0.92282,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-19"],"published":"2015-03-28T00:00:00Z","modified":"2026-10-23T15:47:27Z","fixes":[{"ecosystem":"PyPI","package":"dulwich","fixed_in":["0.9.10","0.9.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5-2+deb7u2"}]}],"versions":["0.8.5-2","0.8.5-2+deb7u1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.10"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9"]},{"source":"osv","ecosystem":"Mageia:4","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dulwich_project","product":"dulwich"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3206","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154551.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://git.samba.org/?p=jelmer/dulwich.git%3Ba=commitdiff%3Bh=091638be3c89f46f42c3b1d57dc1504af5729176","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/22/26","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/21/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence","web"]},{"url":"https://lists.launchpad.net/dulwich-users/msg00827.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154523.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9706","tags":["advisory"]},{"url":"https://git.samba.org/?p=jelmer/dulwich.git;a=commitdiff;h=091638be3c89f46f42c3b1d57dc1504af5729176","tags":["web"]},{"url":"https://github.com/jelmer/dulwich/commit/091638be3c89f46f42c3b1d57dc1504af5729176","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2015-34.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4j5j-58j7-6c3w","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9706","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15558","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3206","tags":["web"]},{"url":"https://git.samba.org/?p=jelmer/dulwich.git;a=blob;f=NEWS;h=d0616a0c","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9706","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","status":"published","published":"2015-03-31T14:00:00Z","modified":"2024-08-06T13:55:04.07Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2015-0019","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","status":"published","published":"2015-03-31T14:00:00Z","modified":"2024-08-06T13:55:04Z","updated_at":"2026-11-03T01:56:47.514809Z"}],"ghsa":[{"id":"GHSA-4j5j-58j7-6c3w","title":"Dulwich Arbitrary code execution via commit with directory path starting with .git","description":"The `build_index_from_tree` function in index.py in Dulwich versions 0.9.9 and below allows remote attackers to execute arbitrary code via a commit with a directory path starting with `.git/`, which is not properly handled when checking out a working tree.","status":"published","published":"2022-05-17T04:14:03Z","modified":"2026-05-14T23:04:27Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2014-9706","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","status":"published","published":"2015-03-31T14:59:04.86Z","modified":"2026-06-17T00:18:50.54Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-19"],"updated_at":"2026-11-02T14:02:58.385843Z"}],"osv":[{"id":"GHSA-4j5j-58j7-6c3w","title":"Dulwich Arbitrary code execution via commit with directory path starting with .git","description":"The `build_index_from_tree` function in index.py in Dulwich versions 0.9.9 and below allows remote attackers to execute arbitrary code via a commit with a directory path starting with `.git/`, which is not properly handled when checking out a working tree.","status":"published","published":"2022-05-17T04:14:03Z","modified":"2026-05-14T23:16:30.098942Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"CVE-2014-9706","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","status":"published","published":"2015-03-31T14:59:04Z","modified":"2026-04-16T06:22:25.96857497Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9706","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","status":"published","published":"2015-03-31T14:59:04.86Z","modified":"2026-10-23T15:47:27.611344159Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DSA-3206-1","title":"dulwich - security update","status":"published","published":"2015-03-28T00:00:00Z","modified":"2026-03-09T01:19:27.818968Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0157","title":"Updated python-dulwich packages fix security vulnerabilities","description":"Updated python-dulwich package fixes security vulnerabilities:\n\nIt was discovered that Dulwich allows writing to files under .git/ when\nchecking out working trees. This could lead to the execution of arbitrary\ncode with the privileges of the user running an application based on Dulwich\n(CVE-2014-9706).\n\nIvan Fratric of the Google Security Team has found a buffer overflow in the\nC implementation of the apply_delta() function, used when accessing Git\nobjects in pack files. An attacker could take advantage of this flaw to\ncause the execution of arbitrary code with the privileges of the user\nrunning a Git server or client based on Dulwich (CVE-2015-0838).\n\nThe python-dulwich package has been updated to version 0.10.0, fixing these\nissues and other bugs.\n","status":"published","published":"2015-04-15T17:22:53Z","modified":"2026-04-16T06:25:31.799874309Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"PYSEC-2015-34","description":"The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.","status":"published","published":"2015-03-31T14:59:00Z","modified":"2026-06-10T17:01:13.097227483Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}