Opened 3 years ago

Closed 2 years ago

#55439 closed defect (fixed)

bzr: Backport fix for CVE-2017-14176

Reported by: raimue (Rainer Müller) Owned by: raimue (Rainer Müller)
Priority: Normal Milestone:
Component: ports Version:
Keywords: security Cc:
Port: bzr

Description

Upstream issue: https://bugs.launchpad.net/bzr/+bug/1710979

Bazaar suffers from the same bug that affects Mercuril and Git:

A hostname that starts with a - is passed on verbatim to the ssh command, which means that the host bit in the URL can be used to set arbitrary SSH options.

E.g. bzr log "bzr+ssh://-oProxyCommand=ls/path"

Presumably this only affects users that are using the Subprocess SSH vendor, and not those using the Paramiko SSH Vendor.

Change History (2)

comment:2 Changed 2 years ago by raimue (Rainer Müller)

Resolution: fixed
Status: newclosed

In 46eb18b78bd08e8bdb9b65563f92e8081d31b14e/macports-ports:

bzr: Apply patch for CVE-2017-14176

Closes: #55439

Note: See TracTickets for help on using tickets.