This bug was fixed in the package bzr - 2.6.0+bzr6593-1ubuntu1.6
---------------
bzr (2.6.0+bzr6593-1ubuntu1.6) trusty-security; urgency=medium
* SECURITY UPDATE: Possible arbitrary code execution on clients
through malicious bzr+ssh URLs
- debian/patches/24_ssh_hostnames-lp1710979: ensure that host
arguments to ssh cannot be treated as ssh options.
- LP: #1710979
-- Steve Beattie <[email protected]> Mon, 28 Aug 2017 23:11:14 -0700
** Changed in: bzr (Ubuntu)
Status: Confirmed => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1710979
Title:
bzr+ssh URLs don't strip SSH options
To manage notifications about this bug go to:
https://bugs.launchpad.net/brz/+bug/1710979/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
