Internet Bug Bounty: RCE via ssh:// URIs in multiple VCS

I’d like to submit an RCE issue within Git SVN and Mercurial, the CVEs are:

• CVE-2017-9800 (Subversion)
• CVE-2017-1000116 (Mercurial (hg))
• CVE-2017-1000117 (Git)

Further Info can be found at:

http://blog.recurity-labs.com/2017-08-10/scm-vulns

And product specific:

• https://public-inbox.org/git/[email protected]/T/#u
• http://subversion.apache.org/security/CVE-2017-9800-advisory.txt
• https://about.gitlab.com/2017/08/10/gitlab-9-dot-4-dot-4-released/

I think these issues which all are based on the same flaw could be worth
an IBB Bounty. However I’d like to point out that we at Recurity Labs
would like the bounty being donated to a charity. The to be determined
charity will be something in the field of brain aneurysm, this is due to
the fact that Felix, the founder of Recurity Labs, currently is
recovering from a brain aneurysm.

So, just let us know what you think about this.

Cheers,

joern

P.S. I took the CVSS Score from the Subversion Advisory
the Redhat advisory states a score of 6.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) I guess the truth is somewhere in between.