Re: CVS and ssh command injection (see CVE-2017-1000117, etc.)

[Salvatore Bonaccorso <carnil () debian org>]

hi

On Fri, Aug 11, 2017 at 10:10:18AM +0200, Andreas Stieger wrote:
> On 08/11/2017 01:32 AM, Hank Leininger wrote:
> > SSH command injection via -o... impacts CVS 1.12.x as well
> > [...]
> > I don't know if these were discussed on a private list prior to publication, and whether that discussion included 
> > CVS.
>
> cvs did not come up in the private discussions that I am aware of,
> thanks for pointing it out.

FWIW, I have requested a CVE via the MITRE webform. Will followup here
once/if it gets assigned.

Regards,
Salvatore