{"id":"CVE-2017-12976","aliases":["DEBIAN-CVE-2017-12976","DLA-1144-1","DLA-1495-1","DSA-4010-1","EUVD-2017-4494","GHSA-jqcx-qqvc-9wx5","HSEC-2023-0009","UBUNTU-CVE-2017-12976"],"status":"published","title":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL...","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0312,"percentile":0.87922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-08-20T20:00:00Z","modified":"2026-09-01T20:03:42Z","fixes":[{"ecosystem":"Debian:12","package":"git-annex","fixed_in":["6.20170818-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"git-annex","fixed_in":["6.20170818-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"git-annex","fixed_in":["6.20170818-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"git-annex","fixed_in":["3.20120629+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"git-annex","fixed_in":["5.20141125+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"git-annex","fixed_in":["6.20170101-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Hackage","package":"git-annex","fixed_in":["6.20170818"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20170818-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20170818-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20170818-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20120629+deb7u1"}]}],"versions":["3.20120629"]},{"source":"osv","ecosystem":"Debian:8","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20141125+oops-1+deb8u2"}]}],"versions":["5.20141125","5.20141125+deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.20141125+deb8u1"}]}],"versions":["5.20141125"]},{"source":"osv","ecosystem":"Debian:9","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20170101-1+deb9u1"}]}],"versions":["6.20170101-1"]},{"source":"osv","ecosystem":"Hackage","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.20170818"}]}],"versions":["3.20110702","3.20110702.2","3.20110705","3.20110707","3.20110819","3.20110902","3.20110906","3.20110915","3.20110928","3.20111011","3.20111122","3.20111203","3.20111211","3.20111231","3.20120113","3.20120115","3.20120116","3.20120123","3.20120227","3.20120229","3.20120230","3.20120309","3.20120315","3.20120405","3.20120406","3.20120418","3.20120430","3.20120511","3.20120522","3.20120605","3.20120611","3.20120614","3.20120615","3.20120624","3.20120629","3.20120721","3.20120807","3.20120825","3.20120924","3.20121001","3.20121009","3.20121010","3.20121016","3.20121017","3.20121112","3.20121126","3.20121127","3.20121127.1","3.20121211","3.20130102","3.20130105","3.20130107","3.20130114","3.20130124","3.20130207","3.20130216.1","4.20130227","4.20130314","4.20130323","4.20130405","4.20130417","4.20130501","4.20130501.1","4.20130516","4.20130521","4.20130521.1","4.20130521.2","4.20130601","4.20130627","4.20130709","4.20130723","4.20130802","4.20130815","4.20130827","4.20130909","4.20130920","4.20130927","4.20131002","4.20131024","4.20131101","4.20131106","5.20131118","5.20131120","5.20131127","5.20131130","5.20131213","5.20131221","5.20131230","5.20140107","5.20140108","5.20140116","5.20140127","5.20140129","5.20140210","5.20140221","5.20140227","5.20140306","5.20140320","5.20140402","5.20140405","5.20140412","5.20140421","5.20140517","5.20140529","5.20140606","5.20140613","5.20140707","5.20140709","5.20140717","5.20140817","5.20140831","5.20140915","5.20140919","5.20140926","5.20140927","5.20141013","5.20141024","5.20141125","5.20141203","5.20141219","5.20141231","5.20150113","5.20150205","5.20150219","5.20150317","5.20150327","5.20150406","5.20150406.1","5.20150409","5.20150420","5.20150508","5.20150508.1","5.20150522","5.20150528","5.20150617","5.20150710","5.20150727","5.20150731","5.20150812","5.20150824","5.20150916","5.20150930","5.20151019","5.20151102","5.20151102.1","5.20151116","5.20151208","5.20151218","6.20160114","6.20160126","6.20160211","6.20160229","6.20160318","6.20160412","6.20160418","6.20160419","6.20160511","6.20160527","6.20160613","6.20160619","6.20160808","6.20160907","6.20160923","6.20161012","6.20161027","6.20161031","6.20161111","6.20161118","6.20161210","6.20170101","6.20170214","6.20170301","6.20170301.1","6.20170321","6.20170510","6.20170519","6.20170520"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"git-annex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.20150731-1build1","5.20151208-1","5.20151208-1build1"]}],"products":[{"vendor":"git-annex_project","product":"git-annex"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://source.git-annex.branchable.com/?p=source.git%3Ba=commit%3Bh=c24d0f0e8984576654e2be149005bc884fe0403a","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://source.git-annex.branchable.com/?p=source.git%3Ba=commit%3Bh=df11e54788b254efebb4898b474de11ae8d3b471","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-4010","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://source.git-annex.branchable.com/?p=source.git%3Ba=blob%3Bf=doc/bugs/dashed_ssh_hostname_security_hole.mdwn","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12976"},{"url":"http://source.git-annex.branchable.com/?p=source.git;a=blob;f=doc/bugs/dashed_ssh_hostname_security_hole.mdwn","tags":["report"]},{"url":"http://source.git-annex.branchable.com/?p=source.git;a=commit;h=c24d0f0e8984576654e2be149005bc884fe0403a","tags":["report"]},{"url":"http://source.git-annex.branchable.com/?p=source.git;a=commit;h=df11e54788b254efebb4898b474de11ae8d3b471","tags":["report"]},{"url":"https://github.com/advisories/GHSA-jqcx-qqvc-9wx5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12976","tags":["advisory"]},{"url":"https://git-annex.branchable.com/security/CVE-2017-12976/","tags":["advisory"]},{"url":"http://source.git-annex.branchable.com/?p=source.git;a=commitdiff;h=df11e54788b254efebb4898b474de11ae8d3b471","tags":["fix"]},{"url":"https://ubuntu.com/security/CVE-2017-12976","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12976","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-12976","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-08-20T20:00:00Z","modified":"2024-08-05T18:51:07.35Z","updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-4494","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-08-20T20:00:00Z","modified":"2024-08-05T18:51:07Z","updated_at":"2026-11-03T02:23:20.155596Z"}],"ghsa":[{"id":"GHSA-jqcx-qqvc-9wx5","title":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL...","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2022-05-14T03:00:58Z","modified":"2025-04-20T03:43:40Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:50.574323Z"}],"nvd":[{"id":"CVE-2017-12976","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-08-20T20:29:00.233Z","modified":"2026-06-17T01:04:14.84Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"CVE-2017-12976","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-08-20T20:29:00.233Z","modified":"2026-03-15T22:14:12.329278Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12976","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-08-20T20:29:00.233Z","modified":"2026-09-01T20:03:42.789805791Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12976","description":"git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-08-20T20:29:00Z","modified":"2025-10-24T04:46:27Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1144-1","title":"git-annex - security update","status":"published","published":"2017-10-26T00:00:00Z","modified":"2026-03-09T01:00:49.221965Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-1495-1","title":"git-annex - security update","status":"published","published":"2018-09-05T00:00:00Z","modified":"2026-03-09T01:18:25.139628Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4010-1","title":"git-annex - security update","status":"published","published":"2017-10-30T00:00:00Z","modified":"2026-03-09T01:20:41.588392Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"HSEC-2023-0009","title":"git-annex command injection via malicious SSH hostname","description":"# *git-annex* command injection via malicious SSH hostname\n\n*git-annex* was vulnerable to the same class of security hole as\ngit's **CVE-2017-1000117**. In several cases, `git-annex` parses a\nrepository URL, and uses it to generate a `ssh` command, with the\nhostname to ssh to coming from the URL. If the hostname it parses is\nsomething like `-eProxyCommand=evil`, this could result in arbitrary\nlocal code execution.\n\nSome details of URL parsing may prevent the exploit working in some\ncases.\n\nExploiting this would involve the attacker tricking the victim into\nadding a remote something like `ssh://-eProxyCommand=evil/blah`.\n\nOne possible avenue for an attacker that avoids exposing the URL to\nthe user is to use `initremote` with an SSH remote, so embedding the\nURL in the *git-annex* branch. Then the victim would enable it with\n`enableremote`.\n\nThis was fixed in version **6.20170818**. Now there's a `SshHost`\ntype that is not allowed to start with a dash, and every invocation\nof `git-annex` uses a function that takes a `SshHost`.\n","status":"published","published":"2025-11-14T14:45:34Z","modified":"2026-02-04T04:19:21.699316Z","updated_at":"2026-11-02T15:47:17.805107Z"}]}}