Описание
Security update for bzr
Bzr was updated to fix a security issue:
- CVE-2017-14176: Avoid code execution using ssh:// url injection (boo#1058214)
Список пакетов
SUSE Linux Enterprise Software Development Kit 11 SP4
bzr-1.8-3.5.1
Ссылки
- Link for SUSE-SU-2018:1489-1
- E-Mail link for SUSE-SU-2018:1489-1
- SUSE Security Ratings
- SUSE Bug 1058214
- SUSE CVE CVE-2017-14176 page
Описание
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
Затронутые продукты
SUSE Linux Enterprise Software Development Kit 11 SP4:bzr-1.8-3.5.1
Ссылки
- CVE-2017-14176
- SUSE Bug 1058214
- SUSE Bug 1071709