CVE-2017-14176: Bazaar Package Remote Command Execution Vulnerability

bzr Updated 19 May 2026

Summary

27/11/2017

Disclosed on

CVE-2017-14176

CVE

No i

Fix available

High

Severity

8.8

CVSS Score

CVE-2017-14176: Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836,... Affected versions are not published. No fix is published. How to fix ↓

Also tracked for

breezy · Debian:11

The same CVE-2017-14176 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Bazaar is a version control system that allows developers to manage changes to source code over time. It supports various workflows and is designed for ease of use, enabling collaboration among developers. However, versions up to 2.7.0 have a critical vulnerability when using Subprocess SSH, which can be exploited by attackers to execute arbitrary commands.

Vulnerability Detail

The vulnerability arises from the handling of bzr+ssh URLs that contain an initial dash character in the hostname. This flaw allows remote attackers to manipulate the SSH command executed by Bazaar, leading to potential arbitrary command execution on the host system. This issue is related to other vulnerabilities such as CVE-2017-9800 and CVE-2017-12836, indicating a broader security concern within the package.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As a temporary workaround, avoid using bzr+ssh URLs with an initial dash character in the hostname until the package can be updated.

Conclusion

CVE-2017-14176 is a significant vulnerability in the Bazaar version control system that can lead to remote command execution. Users are strongly advised to update to the latest version to mitigate this risk. For those unable to update immediately, a workaround is available to limit exposure.

See every vulnerability recorded for bzr →