# CVEs published 2017-08-20

5 CVEs were published on August 20, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-12976](https://cve.now/CVE-2017-12976.md): git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostn (no CVSS)
- [CVE-2017-12966](https://cve.now/CVE-2017-12966.md): The asn1f\_lookup\_symbol\_impl function in asn1fix\_retrieve.c in libasn1fix.a in asn1c 0.9.28 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-12972](https://cve.now/CVE-2017-12972.md): In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers (no CVSS, com.nimbusds:nimbus-jose-jwt)
- [CVE-2017-12973](https://cve.now/CVE-2017-12973.md): Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attacke (no CVSS, com.nimbusds:nimbus-jose-jwt)
- [CVE-2017-12974](https://cve.now/CVE-2017-12974.md): Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve (no CVSS, com.nimbusds:nimbus-jose-jwt)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-08-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.