CVE-2017-12976 json
git-annex command injection via malicious SSH hostname
published 2017-08-20 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-4494 , HSEC-2023-0009
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.
Patch / fix
- hackage git-annex 6.20170818
- git-annex Debian 14, Debian 13, Debian 12 6.20170818-1
debian advisories DEBIAN-CVE-2017-12976
- git-annex Arch Linux 6.20171003-1
arch linux advisories AVG-496
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-12976 updated cvss 7.8
git-annex: RCE via ssh URL with an initial dash character in the hostname
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.12% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| OSV | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hackage | git-annex | <6.20170818 |
6.20170818 |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
source.git-annex.branchable.com
/?p=source.git;a=commitdiff;h=df11e54788b254efebb4898b474de11ae8d3b471
patch
-
debian.org
/security/2017/dsa-4010
vendor-advisory
-
lists.debian.org
/debian-lts-announce/2018/09/msg00004.html
mailing-list
- source.git-annex.branchable.com /?p=source.git%3Ba=commit%3Bh=c24d0f0e8984576654e2be149005bc884fe0403a
- source.git-annex.branchable.com /?p=source.git%3Ba=commit%3Bh=df11e54788b254efebb4898b474de11ae8d3b471
- source.git-annex.branchable.com /?p=source.git%3Ba=blob%3Bf=doc/bugs/dashed_ssh_hostname_security_hole.mdwn
-
git-annex.branchable.com
/security/CVE-2017-12976/
advisory
Sources
- CVE List CVE-2017-12976
- NVD CVE-2017-12976
- OSV HSEC-2023-0009
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.