CVE-2014-9706 : The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows re

The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

Published 2015-03-31 14:59:05

Updated 2015-04-15 02:02:06

Source Debian GNU/Linux

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2014-9706

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Dulwich Project » Dulwich
Versions up to, including, (<=) 0.9.8
cpe:2.3:a:dulwich_project:dulwich:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-9706

EPSS FAQ

12.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-9706

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2014-9706

CWE-19

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-9706

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154551.html

[SECURITY] Fedora 20 Update: python-dulwich-0.10.0-1.fc20
https://lists.launchpad.net/dulwich-users/msg00827.html

Re: Git vulnerability CVE-2014-9390 : Mailing list archive : dulwich-users team in Launchpad
Exploit
http://www.openwall.com/lists/oss-security/2015/03/22/26

oss-security - Re: Possible CVE Request: dulwich: does not prevent to write files in commits with invalid paths to working tree
https://git.samba.org/?p=jelmer/dulwich.git;a=commitdiff;h=091638be3c89f46f42c3b1d57dc1504af5729176

git.samba.org - jelmer/dulwich.git/commitdiff
http://www.debian.org/security/2015/dsa-3206

Debian -- Security Information -- DSA-3206-1 dulwich

CVEs referencing this url
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154523.html

[SECURITY] Fedora 21 Update: python-dulwich-0.10.0-1.fc21
http://www.openwall.com/lists/oss-security/2015/03/21/1

oss-security - Possible CVE Request: dulwich: does not prevent to write files in commits with invalid paths to working tree
Exploit

Jump to

Vulnerability Details : CVE-2014-9706

Products affected by CVE-2014-9706

Exploit prediction scoring system (EPSS) score for CVE-2014-9706

CVSS scores for CVE-2014-9706

CWE ids for CVE-2014-9706

References for CVE-2014-9706