[Bug 1710979] Re: bzr+ssh URLs don't strip SSH options

[Bernhard M. Wiedemann]

fix is still missing in bzr repo

** Attachment added: "fix"
   https://bugs.launchpad.net/bzr/+bug/1710979/+attachment/5140728/+files/24_ssh_hostnames-lp1710979

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to bzr in Ubuntu.
https://bugs.launchpad.net/bugs/1710979

Title:
  bzr+ssh URLs don't strip SSH options

Status in Breezy:
  Fix Released
Status in Bazaar:
  Confirmed
Status in bzr package in Ubuntu:
  Fix Released

Bug description:
  Bazaar suffers from the same bug that affects Mercuril and Git:

  A hostname that starts with a - is passed on verbatim to the ssh
  command, which means that the host bit in the URL can be used to set
  arbitrary SSH options.

  E.g.  bzr log "bzr+ssh://-oProxyCommand=ls/path"

  Presumably this only affects users that are using the Subprocess SSH
  vendor, and not those using the Paramiko SSH Vendor.

  See e.g. https://security-tracker.debian.org/tracker/CVE-2017-1000117
  for the Git advisory.

To manage notifications about this bug go to:
https://bugs.launchpad.net/brz/+bug/1710979/+subscriptions