[Bug 1710979] Re: bzr+ssh URLs don't strip SSH options

[Jelmer Vernooij]

I've just done so.

** Information type changed from Private Security to Public

** Information type changed from Public to Public Security

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to bzr in Ubuntu.
https://bugs.launchpad.net/bugs/1710979

Title:
  bzr+ssh URLs don't strip SSH options

Status in Breezy:
  Triaged
Status in Bazaar:
  Confirmed
Status in bzr package in Ubuntu:
  Confirmed

Bug description:
  Bazaar suffers from the same bug that affects Mercuril and Git:

  A hostname that starts with a - is passed on verbatim to the ssh
  command, which means that the host bit in the URL can be used to set
  arbitrary SSH options.

  E.g.  bzr log "bzr+ssh://-oProxyCommand=ls/path"

  Presumably this only affects users that are using the Subprocess SSH
  vendor, and not those using the Paramiko SSH Vendor.

  See e.g. https://security-tracker.debian.org/tracker/CVE-2017-1000117
  for the Git advisory.

To manage notifications about this bug go to:
https://bugs.launchpad.net/brz/+bug/1710979/+subscriptions