CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade cvs | Aug 22, 2024 | Aug 24, 2017 |
| Debian | — | Upgrade cvs | Aug 14, 2017 | Aug 13, 2017 |
| Freebsd | — | Upgrade cvs | Feb 27, 2018 | Feb 24, 2018 |
| Gentoo Linux | — | Upgrade dev-vcs/cvs. | Oct 30, 2017 | Aug 24, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade cvs | Nov 3, 2020 | Aug 24, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade cvs | Sep 28, 2020 | Aug 24, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade cvs | Nov 2, 2020 | Aug 24, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4Upgrade developer/versioning/cvs to version 1.12.13-0.175.3.24.0.3.0 on Solaris 11.3 | Sep 19, 2017 | Aug 24, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 10, 2017 |
| Suse | — | Upgrade cvsUpgrade cvs-doc | Sep 12, 2017 | Aug 13, 2017 |
| Ubuntu | — | Upgrade cvs | Aug 21, 2017 | Aug 13, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub