{"action":"Upgrade dulwich to 0.18.5-1 or later.","affected":[{"fixed":"0.18.5-1","introduced":"0"}],"component":"dulwich","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["0.18.5-1"],"id":"tcs_01M5NC7E0G6S514R2WP6VM7FSC","modified_at":"2026-09-01T20:03:44.855328562Z","published_at":"2017-10-29T20:29:00.237Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2017-16228","https://security-tracker.debian.org/tracker/CVE-2017-16228"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2017-16228#Debian:13/dulwich","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2017-16228"}],"summary":"Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-"}