{"id":"CVE-2017-16228","aliases":["DEBIAN-CVE-2017-16228","EUVD-2017-0027","GHSA-cwwh-4382-6fwr","MGASA-2018-0445","PYSEC-2017-12","SUSE-SU-2018:2047-1","UBUNTU-CVE-2017-16228","openSUSE-SU-2024:11228-1","openSUSE-SU-2024:14139-1","openSUSE-SU-2026:11190-1"],"status":"published","title":"Dulwich RCE Vulnerability","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03809,"percentile":0.90095,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2017-10-29T20:00:00Z","modified":"2026-10-24T10:31:06Z","fixes":[{"ecosystem":"PyPI","package":"dulwich","fixed_in":["0.18.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dulwich","fixed_in":["0.18.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dulwich","fixed_in":["0.18.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["0.18.5-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"python-dulwich","fixed_in":["0.12.0-1.2.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-dulwich","fixed_in":["0.18.5-4.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.10.0","0.10.1a","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.3","0.17.1","0.17.2","0.17.3","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9"]},{"source":"osv","ecosystem":"Mageia:6","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-1.2.mga6"}]}]},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.10.0","0.10.1a","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.16.2","0.16.3","0.17.1","0.17.2","0.17.3","0.18.0","0.18.1","0.18.2","0.18.3","0.18.4","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-4.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.2-1ubuntu1","0.12.0-1","0.12.0-1build1","0.12.0-1build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.7-1.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-1.1"}]}],"bundled":2}],"products":[{"vendor":"dulwich_project","product":"dulwich"}],"references":[{"url":"https://tracker.debian.org/news/882440","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://www.dulwich.io/code/dulwich/","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16228","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2017-12.yaml","tags":["web"]},{"url":"https://web.archive.org/web/20201220231743/https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6","tags":["web"]},{"url":"https://web.archive.org/web/20210128154006/https://www.dulwich.io/code/dulwich","tags":["web"]},{"url":"https://www.dulwich.io/code/dulwich","tags":["web"]},{"url":"https://www.dulwich.io/code/dulwich/commit/7116a0cbbda571f7dac863f4b1c00b6e16d6d8d6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cwwh-4382-6fwr","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16228","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2018-0445.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23346","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-08/msg00028.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182047-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1066430","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16228","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-16228","tags":["report"]},{"url":"https://www.bleepingcomputer.com/news/security/git-project-patches-remote-code-execution-vulnerability-in-git/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16228","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0838","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-16228","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:00:00Z","modified":"2024-08-05T20:20:05.213Z","updated_at":"2026-11-02T14:33:21.453505Z"}],"euvd":[{"id":"EUVD-2017-0027","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:00:00Z","modified":"2024-08-05T20:20:05Z","updated_at":"2026-11-03T02:23:12.944585Z"}],"ghsa":[{"id":"GHSA-cwwh-4382-6fwr","title":"Dulwich RCE Vulnerability","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2022-05-13T01:44:04Z","modified":"2024-09-20T16:44:57Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2017-16228","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:29:00.237Z","modified":"2026-06-17T01:09:00.797Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:04:08.01771Z"}],"osv":[{"id":"CVE-2017-16228","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:29:00.237Z","modified":"2026-10-24T10:31:06.600360239Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16228","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:29:00.237Z","modified":"2026-09-01T20:03:44.855328562Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"GHSA-cwwh-4382-6fwr","title":"Dulwich RCE Vulnerability","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2022-05-13T01:44:04Z","modified":"2024-11-30T05:33:25.494557Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"UBUNTU-CVE-2017-16228","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:29:00Z","modified":"2025-10-24T04:46:34Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"MGASA-2018-0445","title":"Updated python-dulwich packages fix security vulnerability","description":"Dulwich, when an SSH subprocess is used, allowed remote attackers to\nexecute arbitrary commands via an ssh URL with an initial dash character\nin the hostname (CVE-2017-16228).\n","status":"published","published":"2018-11-11T21:39:12Z","modified":"2026-04-16T06:25:55.833457518Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11228-1","title":"python36-dulwich-0.20.24-1.3 on GA media","description":"These are all security issues fixed in the python36-dulwich-0.20.24-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:12.385954Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14139-1","title":"python310-dulwich-0.21.7-1.3 on GA media","description":"These are all security issues fixed in the python310-dulwich-0.21.7-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T02:20:08.348647Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11190-1","title":"python313-dulwich-1.2.7-1.1 on GA media","description":"These are all security issues fixed in the python313-dulwich-1.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-06T00:00:00Z","modified":"2026-07-07T08:30:07.572118855Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2017-12","description":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.","status":"published","published":"2017-10-29T20:29:00Z","modified":"2026-06-10T17:01:13.16161247Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2018:2047-1","title":"Security update for python-dulwich","description":"This update for python-dulwich to version 0.18.5 fixes this security issue:\n\n- CVE-2017-16228: Dulwich, when an SSH subprocess is used, allowed remote\n  attackers to execute arbitrary commands via an ssh URL with an initial dash\n  character in the hostname (bsc#1066430).\n\nFor detailed changes please see https://www.dulwich.io/code/dulwich/\n  ","status":"published","published":"2018-07-24T07:20:39Z","modified":"2026-02-04T03:26:17.134723Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}