vulnerability
FreeBSD: VID-d9fe59ea-1940-11e8-9eb8-5404a68ad561 (CVE-2017-12836): cvs -- Remote code execution via ssh command injection
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:H/Au:N/C:P/I:P/A:P) | Feb 24, 2018 | Feb 27, 2018 | Dec 10, 2025 |
Severity
5
CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
Published
Feb 24, 2018
Added
Feb 27, 2018
Modified
Dec 10, 2025
Description
Hank Leininger reports: Bugs in Git, Subversion, and Mercurial were just announced and patched which allowed arbitrary local command execution if a malicious name was used for the remote server, such as starting with - to pass options to the ssh client: git clone ssh://-oProxyCommand=some-command... CVS has a similar problem with the -d option: Tested vanilla CVS 1.12.13, and Gentoo CVS 1.12.12-r11.
Solution
freebsd-upgrade-package-cvs
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.