7.5

CVE-2017-12836: canonical ubuntu_linux

CVSS: 7.5v3.0HighModified
AliasesALPINE-CVE-2017-12836MGASA-2017-0284SUSE-SU-2017:2419-1
Published 24-08-2017Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2017-12836 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 6.64% chance of exploitation in the next 30 days, higher than 93.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
41/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
6.64%
0%100%
Low · +0.63 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Timeline

  1. 24-08-2017
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

CVS 1.12.x, when configured to use SSH for remote repositories, might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname, as demonstrated by "-oProxyCommand=id;localhost:/bar."

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

6.64%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

+0.63 pp

From 6.02% on 19-09-2026

19-09-202619-10-2026
EPSS score
6.64%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (lists.nongnu.org)

    Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Suse10 products
  • cvs&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.12.12-182.3.1
  • cvs&distro=SUSE Linux Enterprise Desktop 12 SP3< 1.12.12-182.3.1
  • cvs&distro=SUSE Linux Enterprise Server 11 SP4< 1.12.12-144.23.5.3.1
  • cvs&distro=SUSE Linux Enterprise Server 12 SP2< 1.12.12-182.3.1
  • cvs&distro=SUSE Linux Enterprise Server 12 SP3< 1.12.12-182.3.1
Debian2 products
  • cvs< 2:1.12.13+real-24 | < 2:1.12.13+real-15+deb8u1 | < 2:1.12.13+real-22+deb9u1 | < 2:1.12.13+real-9+deb7u1
  • debian_linuxEOL8.0 | 9.0
Mageia2 products
  • cvs< 1.12.13-25.1.mga5
  • cvs< 1.12.13-26.1.mga6
Alpine1 product
  • cvs< 1.12.12-r0
Canonical1 product
Gnu1 product
  • cvs1.12.1 | 1.12.3 | 1.12.5 | 1.12.6 | 1.12.7 | 1.12.9 | 1.12.10 | 1.12.11 | 1.12.12 | 1.12.13
Opensuse1 product
  • cvs&distro=openSUSE Tumbleweed< 1.12.13-1.14
Ubuntu1 product
  • cvs< 2:1.12.13+real-12ubuntu0.1 | < 2:1.12.13+real-15ubuntu0.1

8 vendors · 19 products

References

20 links
Show all 20 references