https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 17:05:21 +0000 https://vulnerability.circl.lu/vuln/cve-2017-1000117 <p>A malicious third-party can give a crafted &#34;ssh://...&#34; URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim&#39;s machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running &#34;git clone --recurse-submodules&#34; to trigger the vulnerability.</p> <p>A malicious third-party can give a crafted &#34;ssh://...&#34; URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim&#39;s machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running &#34;git clone --recurse-submodules&#34; to trigger the vulnerability.</p> https://vulnerability.circl.lu/vuln/cve-2017-1000117 https://vulnerability.circl.lu/vuln/usn-3387-1 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: git, Ubuntu:16.04:LTS: git</p> <p>Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did not properly handle host names in &#39;ssh://&#39; URLs. A remote attacker could use this to construct a git repository that when accessed could run arbitrary code with the privileges of the user.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: git, Ubuntu:16.04:LTS: git</p> <p>Brian Neel, Joern Schneeweisz, and Jeff King discovered that Git did not properly handle host names in &#39;ssh://&#39; URLs. A remote attacker could use this to construct a git repository that when accessed could run arbitrary code with the privileges of the user.</p> https://vulnerability.circl.lu/vuln/usn-3387-1