Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS00ajVqLTU4ajctNmMzd84AAdzt
Dulwich Arbitrary code execution via commit with directory path starting with .git
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00ajVqLTU4ajctNmMzd84AAdzt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: 23 days ago
CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-4j5j-58j7-6c3w, CVE-2014-9706
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-9706
- https://git.samba.org/?p=jelmer/dulwich.git;a=commitdiff;h=091638be3c89f46f42c3b1d57dc1504af5729176
- https://lists.launchpad.net/dulwich-users/msg00827.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154523.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154551.html
- http://www.debian.org/security/2015/dsa-3206
- http://www.openwall.com/lists/oss-security/2015/03/21/1
- http://www.openwall.com/lists/oss-security/2015/03/22/26
- https://github.com/jelmer/dulwich/commit/091638be3c89f46f42c3b1d57dc1504af5729176
- https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2015-34.yaml
- https://github.com/advisories/GHSA-4j5j-58j7-6c3w
Blast Radius: 34.0
Affected Packages
pypi:dulwich
Dependent packages: 148Dependent repositories: 2,931
Downloads: 46,076,248 last month
Affected Version Ranges: < 0.9.9
Fixed in: 0.9.9
All affected versions: 0.0.1, 0.1.0, 0.1.1, 0.2.1, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.4.0, 0.4.1, 0.5.0, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.5, 0.8.6, 0.8.7, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.9.8
All unaffected versions: 0.9.9, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.13.0, 0.14.0, 0.14.1, 0.15.0, 0.16.0, 0.16.1, 0.16.2, 0.16.3, 0.17.1, 0.17.2, 0.17.3, 0.18.0, 0.18.1, 0.18.2, 0.18.3, 0.18.4, 0.18.5, 0.18.6, 0.19.0, 0.19.1, 0.19.2, 0.19.3, 0.19.4, 0.19.5, 0.19.6, 0.19.7, 0.19.8, 0.19.9, 0.19.10, 0.19.11, 0.19.12, 0.19.13, 0.19.14, 0.19.15, 0.19.16, 0.20.0, 0.20.1, 0.20.2, 0.20.3, 0.20.4, 0.20.5, 0.20.6, 0.20.7, 0.20.8, 0.20.9, 0.20.10, 0.20.11, 0.20.12, 0.20.13, 0.20.14, 0.20.15, 0.20.17, 0.20.18, 0.20.19, 0.20.20, 0.20.21, 0.20.22, 0.20.23, 0.20.24, 0.20.25, 0.20.26, 0.20.27, 0.20.28, 0.20.29, 0.20.30, 0.20.31, 0.20.32, 0.20.33, 0.20.34, 0.20.35, 0.20.36, 0.20.37, 0.20.38, 0.20.39, 0.20.40, 0.20.41, 0.20.42, 0.20.43, 0.20.44, 0.20.45, 0.20.46, 0.20.47, 0.20.48, 0.20.49, 0.20.50, 0.21.0, 0.21.1, 0.21.2, 0.21.3, 0.21.4, 0.21.5, 0.21.6, 0.21.7, 0.22.0, 0.22.1