CVE-2017-14176: Canonical Bazaar

High severity, CVSS 8.8. EPSS: 6.3% chance of exploitation in the next 30 days.

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117.

Affected products

• Canonical Bazaar: up to and including 2.7.0
• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only

Published 2017-11-27. Last modified 2026-06-17.