{"id":"CVE-2017-12426","details":"GitLab Community Edition (CE) and Enterprise Edition (EE) before 8.17.8, 9.0.x before 9.0.13, 9.1.x before 9.1.10, 9.2.x before 9.2.10, 9.3.x before 9.3.10, and 9.4.x before 9.4.4 might allow remote attackers to execute arbitrary code via a crafted SSH URL in a project import.","modified":"2026-08-27T18:59:49.815590Z","published":"2017-08-14T21:29:00.213Z","related":["CGA-qmqh-gfx7-4794"],"references":[{"type":"WEB","url":"https://www.mail-archive.com/linux-kernel%40vger.kernel.org/msg1466490.html"},{"type":"ADVISORY","url":"https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.com/gitlab-org/gitlab","events":[{"introduced":"0"},{"last_affected":"7e684a332ccd51de718a2f5f88060b0913a1b008"},{"introduced":"f33774cb120324d428dabf52c89b8a65e4d4c166"},{"last_affected":"9f45c3206f59ac6dca25947832d701ce67065f8d"}],"database_specific":{"cpe":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.8:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.9:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.10:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.10:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.11:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.11:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.12:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.0.12:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.8:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.9:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.1.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.8:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.9:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.2.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.3:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.4:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.4:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.5:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.6:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.6:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.7:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.7:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.8:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.8:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.9:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.3.9:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.0:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.0:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.1:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.1:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.2:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.3:*:*:*:community:*:*:*","cpe:2.3:a:gitlab:gitlab:9.4.3:*:*:*:enterprise:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"8.17.7"},{"introduced":"9.0.0"},{"last_affected":"9.0.0"},{"introduced":"9.0.1"},{"last_affected":"9.0.1"},{"introduced":"9.0.2"},{"last_affected":"9.0.2"},{"introduced":"9.0.3"},{"last_affected":"9.0.3"},{"introduced":"9.0.4"},{"last_affected":"9.0.4"},{"introduced":"9.0.5"},{"last_affected":"9.0.5"},{"introduced":"9.0.6"},{"last_affected":"9.0.6"},{"introduced":"9.0.7"},{"last_affected":"9.0.7"},{"introduced":"9.0.8"},{"last_affected":"9.0.8"},{"introduced":"9.0.9"},{"last_affected":"9.0.9"},{"introduced":"9.0.10"},{"last_affected":"9.0.10"},{"introduced":"9.0.11"},{"last_affected":"9.0.11"},{"introduced":"9.0.12"},{"last_affected":"9.0.12"},{"introduced":"9.1.0"},{"last_affected":"9.1.0"},{"introduced":"9.1.1"},{"last_affected":"9.1.1"},{"introduced":"9.1.2"},{"last_affected":"9.1.2"},{"introduced":"9.1.3"},{"last_affected":"9.1.3"},{"introduced":"9.1.4"},{"last_affected":"9.1.4"},{"introduced":"9.1.5"},{"last_affected":"9.1.5"},{"introduced":"9.1.6"},{"last_affected":"9.1.6"},{"introduced":"9.1.7"},{"last_affected":"9.1.7"},{"introduced":"9.1.8"},{"last_affected":"9.1.8"},{"introduced":"9.1.9"},{"last_affected":"9.1.9"},{"introduced":"9.2.0"},{"last_affected":"9.2.0"},{"introduced":"9.2.1"},{"last_affected":"9.2.1"},{"introduced":"9.2.2"},{"last_affected":"9.2.2"},{"introduced":"9.2.3"},{"last_affected":"9.2.3"},{"introduced":"9.2.4"},{"last_affected":"9.2.4"},{"introduced":"9.2.5"},{"last_affected":"9.2.5"},{"introduced":"9.2.6"},{"last_affected":"9.2.6"},{"introduced":"9.2.7"},{"last_affected":"9.2.7"},{"introduced":"9.2.8"},{"last_affected":"9.2.8"},{"introduced":"9.2.9"},{"last_affected":"9.2.9"},{"introduced":"9.3.0"},{"last_affected":"9.3.0"},{"introduced":"9.3.1"},{"last_affected":"9.3.1"},{"introduced":"9.3.2"},{"last_affected":"9.3.2"},{"introduced":"9.3.3"},{"last_affected":"9.3.3"},{"introduced":"9.3.4"},{"last_affected":"9.3.4"},{"introduced":"9.3.5"},{"last_affected":"9.3.5"},{"introduced":"9.3.6"},{"last_affected":"9.3.6"},{"introduced":"9.3.7"},{"last_affected":"9.3.7"},{"introduced":"9.3.8"},{"last_affected":"9.3.8"},{"introduced":"9.3.9"},{"last_affected":"9.3.9"},{"introduced":"9.4.0"},{"last_affected":"9.4.0"},{"introduced":"9.4.1"},{"last_affected":"9.4.1"},{"introduced":"9.4.2"},{"last_affected":"9.4.2"},{"introduced":"9.4.3"},{"last_affected":"9.4.3"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["9.0.0","9.0.1","9.0.10","9.0.11","9.0.12","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.0.9","9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7","9.1.8","9.1.9","9.2.0","9.2.1","9.2.2","9.2.3","9.2.4","9.2.5","9.2.6","9.2.7","9.2.8","9.2.9","9.3.0","9.3.1","9.3.2","9.3.3","9.3.4","9.3.5","9.3.6","9.3.7","9.3.8","9.3.9","9.4.0","9.4.1","9.4.2","9.4.3","v8.17.7-ee","v9.4.3-ee","v9.4.2-ee","v9.4.1-ee","v9.4.0-ee","v9.4.0-rc6-ee","v9.4.0-rc5-ee","v9.4.0-rc4-ee","v8.17.6-ee","v9.4.0-rc3-ee","v9.4.0-rc2-ee","v9.4.0-rc1-ee","v8.17.5-ee","v8.17.4-ee","v8.17.3-ee","v8.17.2-ee","v8.17.1-ee","v8.17.0-ee","v8.17.0-rc5-ee","v8.17.0-rc4-ee","v8.17.0-rc3-ee","v8.17.0-rc2-ee","v8.17.0-rc1-ee","v7.3.0-ee","v7.3.0.rc1-ee","v7.2.0.rc5-ee","v7.2.0.rc4-ee","v7.2.0.rc3-ee","v7.2.0.rc2-ee","v7.2.0.rc1-ee","v7.1.0-ee","v7.1.0.rc1-ee","v7.0.0-ee","v6.8.0-ee","v6.7.0-ee","v6.7.0.rc1-ee","v6.6.0-ee","v6.5.0-ee","v6.4.0-ee","v6.3.1-ee","v6.3.0-ee","v6.1.0-ee","v6.0.0-ee","v6.0.0-ee.rc1","v6.0.0-ee.beta","v5.2.0","v5.1.0","v5.0.0","v4.0.0","v4.0.0rc2","v4.0.0rc1","v3.1.0","v3.0.3","v3.0.2","v3.0.1","v3.0.0","v2.9.1","v2.9.0","v2.8.2","v2.8.1","v2.8.0","v2.8.0pre","v2.7.0","v2.7.0pre","v2.6.3","v2.6.2","v2.6.1","v2.6.0","v2.6.0pre","v2.5.0","v2.4.1","v2.4.0","v2.4.0pre","v2.3.1","v2.3.0","v2.3.0pre","v1.2.2","v1.2.1","v1.2.0","v1.2.0pre"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12426.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}