CVE-2017-16228: Dulwich SSH Command Execution
Summary
CVE-2017-16228: Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836... Affects dulwich versions < 0.18.5. Fixed in 0.18.5. How to fix ↓
Also tracked for
- dulwich · Debian:11
The same CVE-2017-16228 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Dulwich is a Python library that provides an interface to interact with Git repositories. It allows users to perform various Git operations programmatically. However, versions of Dulwich prior to 0.18.5 are vulnerable to a command execution issue when an SSH subprocess is used. This vulnerability can be exploited by remote attackers through an SSH URL with an initial dash character in the hostname. This issue is related to several other CVEs, including CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Vulnerability Detail
The vulnerability in Dulwich allows remote attackers to execute arbitrary commands. By crafting a malicious SSH URL with a dash character at the beginning of the hostname, an attacker can inject arbitrary commands that will be executed by the SSH subprocess. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system. It is crucial to update Dulwich to version 0.18.5 or later to mitigate this vulnerability.
How To Fix
Latest published version: 1.2.19 as of 23 Oct 2026
pip install --upgrade "dulwich==1.2.19"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.18.5
This is the first release that contains the fix.
pip install --upgrade "dulwich==0.18.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Dulwich allows remote command execution, posing a significant risk to the affected systems. It is crucial to update Dulwich to version 0.18.5 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dulwich →
FAQ
Dulwich is a Python library that provides an interface to interact with Git repositories. It allows users to perform various Git operations programmatically.
This vulnerability allows remote attackers to execute arbitrary commands on the affected system. It can lead to unauthorized access, data leakage, or complete compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can simply provide your Pipfile.lock to analyze the vulnerability status.
Currently, there are no known workarounds for this vulnerability. It is recommended to update Dulwich to the latest version.
You can find more information about this vulnerability in the Dulwich advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/dulwich/PYSEC-2017-12.yaml
Related vulnerabilities
Recent vulnerabilities recorded for dulwich.
