CVE-2017-12976

HIGH8.8EPSS 0.27%

git-annex - security update

Published: 11/14/2025Modified: 3/9/2026
Also known as:DEBIAN-CVE-2017-12976DLA-1144-1HSEC-2023-0009

Description

git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, as demonstrated by an ssh://-eProxyCommand= URL, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-1000116, and CVE-2017-1000117.

Affected packages (5)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (3)