CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cvs: Command injection via malicious ssh URLs (CVE-2017-12836)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cvs: Command injection via malicious ssh URLs (CVE-2017-12836)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - cvs: Command injection via malicious ssh URLs (CVE-2017-12836)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

According to the version of the cvs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - CVS 1.12.x, when configured to use SSH for remote     repositories, might allow remote attackers to execute     arbitrary code via a repository URL with a crafted     hostname, as demonstrated by     '-oProxyCommand=idlocalhost:/bar.'(CVE-2017-12836)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the cvs package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - CVS 1.12.x, when configured to use SSH for remote     repositories, might allow remote attackers to execute     arbitrary code via a repository URL with a crafted     hostname, as demonstrated by     '-oProxyCommand=idlocalhost:/bar.'(CVE-2017-12836)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hank Leininger reports :

Bugs in Git, Subversion, and Mercurial were just announced and patched which allowed arbitrary local command execution if a malicious name was used for the remote server, such as starting with - to pass options to the ssh client : git clone ssh://-oProxyCommand=some-command... CVS has a similar problem with the -d option :

Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.

The remote host is affected by the vulnerability described in GLSA-201709-17 (CVS: Command injection)

    It was discovered that when CVS is configured to use SSH for remote       repositories it allows remote attackers to execute arbitrary code through       a repository URL with a specially crafted hostname.
  Impact :

    A remote attacker, by enticing a user to clone a specially crafted       repository, could possibly execute arbitrary code with the privileges of       the process.
  Workaround :

    There is no known workaround at this time.

This update for cvs fixes the following issues :

  - CVE-2017-12836: A leading dash in the argument of the     '-d' option could lead to argument injection     (bsc#1053364) This update was imported from the     SUSE:SLE-12:Update update project.

This update for cvs fixes the following issues :

  - CVE-2017-12836: A leading dash in the argument of the     '-d' option could lead to argument injection     (bsc#1053364)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This relase fixes CVE-2017-12836 vulerbaility (command injection via malicious SSH URL).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-3399-1 advisory.

    Hank Leininger discovered that cvs did not properly handle SSH for remote repositories. A remote attacker     could use this to construct a cvs repository that when accessed could run arbitrary code with the     privileges of the user.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that CVS, a centralised version control system, did not correctly handle maliciously constructed repository URLs, which allowed an attacker to run an arbitrary shell command.

It was discovered that there was a command injection vulnerability in the CVS revision control system.

For Debian 7 'Wheezy', this issue has been fixed in cvs version 2:1.12.13+real-9+deb7u1.

We recommend that you upgrade your cvs packages. Thanks to Thorsten Glaser <tg@mirbsd.de> for preparing and testing this upload.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199248	RHEL 6 : cvs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199227	RHEL 7 : cvs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199186	RHEL 5 : cvs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
147507	EulerOS Virtualization 3.0.6.6 : cvs (EulerOS-SA-2021-1467)	Nessus	Huawei Local Security Checks	high
142237	EulerOS 2.0 SP2 : cvs (EulerOS-SA-2020-2338)	Nessus	Huawei Local Security Checks	high
142082	EulerOS 2.0 SP5 : cvs (EulerOS-SA-2020-2280)	Nessus	Huawei Local Security Checks	high
140895	EulerOS 2.0 SP3 : cvs (EulerOS-SA-2020-2128)	Nessus	Huawei Local Security Checks	high
106996	FreeBSD : cvs -- Remote code execution via ssh command injection (d9fe59ea-1940-11e8-9eb8-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high
103445	GLSA-201709-17 : CVS: Command injection	Nessus	Gentoo Local Security Checks	high
103285	openSUSE Security Update : cvs (openSUSE-2017-1060)	Nessus	SuSE Local Security Checks	high
103178	SUSE SLES11 Security Update : cvs (SUSE-SU-2017:2422-1)	Nessus	SuSE Local Security Checks	high
103176	SUSE SLED12 / SLES12 Security Update : cvs (SUSE-SU-2017:2419-1)	Nessus	SuSE Local Security Checks	high
102831	Fedora 26 : cvs (2017-e5a78c5ca9)	Nessus	Fedora Local Security Checks	high
102829	Fedora 25 : cvs (2017-97eb475d93)	Nessus	Fedora Local Security Checks	high
102680	Ubuntu 14.04 LTS / 16.04 LTS : cvs vulnerability (USN-3399-1)	Nessus	Ubuntu Local Security Checks	high
102447	Debian DSA-3940-1 : cvs - security update	Nessus	Debian Local Security Checks	high
102441	Debian DLA-1056-1 : cvs security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-12836

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high