The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade dulwich | Jul 30, 2024 | Oct 29, 2017 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Oct 29, 2017 |
| Suse | — | Upgrade python-dulwich | Aug 7, 2018 | Oct 29, 2017 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Oct 29, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub