PatchTheCVEdulwich vulnerabilities and fixes
Recent CVEs affecting dulwich, with upgrade or downgrade steps. 3 tracked.
dulwich has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2017-10-29. Highest priority: CVE-2017-16228 (score 62/100).
- CVE-2017-16228 CRITICAL 9.8 UPGRADE Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands v
- CVE-2015-0838 HIGH 7.5 MITIGATE UPGRADE Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows
- CVE-2014-9706 HIGH 7.5 MITIGATE UPGRADE The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbi
FAQ
How do I fix dulwich vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dulwich being exploited right now?
None of the tracked dulwich CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dulwich CVE should I patch first?
CVE-2017-16228 currently ranks highest (62/100): Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands v.