CVE-2017-14176: canonical bazaar
Vulnerability summary
CVE-2017-14176 is a high (CVSS 9.3) vulnerability in canonical bazaar. EPSS estimates a 6.24% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities.
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 27-11-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.24%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Increase +0.22 pp
From 6.03% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Debian3 products
- breezy< 3.0.0~bzr6772-1
- bzr< 2.7.0+bzr6622-7 | < 2.6.0+bzr6595-6+deb8u1 | < 2.7.0+bzr6619-7+deb9u1
- debian_linuxEOL8.0 | 9.0
Canonical2 products
- bazaar≤ 2.7.0
- ubuntu_linuxEOL14.04 | 16.04 | 17.04
PyPI1 product
- bzr≤ 2.7.0
Suse1 product
- bzr&distro=SUSE Linux Enterprise Software Development Kit 11 SP4< 1.8-3.5.1
Ubuntu1 product
- bzr< 2.6.0+bzr6593-1ubuntu1.6 | < 2.7.0-2ubuntu3.1
5 vendors · 8 products
References
18 links
www.debian.org/security/2017/dsa-4052Vendor AdvisoryX Refsource DEBIANIssue TrackingThird Party AdvisoryWEBREPORT- bugzilla.suse.com/show_bug.cgi?id=1058214X Refsource CONFIRMIssue TrackingThird Party AdvisoryWEBREPORT
- people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14176.htmlX Refsource CONFIRMIssue TrackingVendor AdvisoryWEBREPORT
- bugzilla.redhat.com/show_bug.cgi?id=1486685X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryWEBFIX
