http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - http_transport.c in Fossil before 2.4, when the SSH sync protocol is used, allows user-assisted remote     attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a     related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-14176, CVE-2017-16228,     CVE-2017-1000116, and CVE-2017-1000117. (CVE-2017-17459)

Note that Nessus relies on the presence of the package as reported by the vendor.

- Update to 2.8 fixes rhbz#1581180 rhbz#1603993     rhbz#1674893 and rhbz#1524335

  - Removed upstreamed patch

  - Bug 1524335 - CVE-2017-17459 fossil: Command injection     via malicious ssh URLs [fedora-all]

  - Bug 1581180 - Update fossil version to 2.6 (currently is     2.2)

  - Bug 1603993 - fossil: FTBFS in Fedora rawhide

  - Bug 1674893 - fossil: FTBFS in Fedora rawhide/f30

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201801-20 (Fossil: User-assisted execution of arbitrary code)

    Fossil does not properly validate SSH sync protocol URLs.
  Impact :

    A remote attacker, by enticing a user to open a specially crafted URL,       could possibly execute arbitrary commands with the privileges of the user       running the application.
  Workaround :

    There is no known workaround at this time.

This update for fossil to version 2.4 fixes the following issues :

  - CVE-2017-17459: Client-side code execution via crafted     'ssh://' URLs (bsc#1071709)

The impact of this vulnerability is more limited than similar vectors fixed in other SCMs, as there is no known way to mask the repository URL or otherwise trigger non-interactively.

This update also contains all bug fixes and improvements in the 2.4 release :

  - URL Aliases

  - tech-note search capability

  - Various added command line options

  - Annation depth is now configurable

The following legacy options are no longer available :

  - --no-dir-symlinks option

  - legacy configuration sync protocol

ID	Name	Product	Family	Severity
256725	Linux Distros Unpatched Vulnerability : CVE-2017-17459	Nessus	Misc.	high
126665	Fedora 30 : fossil (2019-f350634b40)	Nessus	Fedora Local Security Checks	high
106429	GLSA-201801-20 : Fossil: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
105245	openSUSE Security Update : fossil (openSUSE-2017-1365)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-17459

high

Tenable Plugins

high

high

high

high