PT-2017-3414 · Mercurial+2 · Mercurial+2

Zhang Tianqi · Publicado 2017-11-02 · Atualizado 2024-06-15 · CVE-2017-17458

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.4.1

Description The issue is related to the execution of arbitrary code through a specially malformed repository. This can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. The typical use of Mercurial prevents the construction of such repositories, but they can be created programmatically.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the creation of repositories to prevent the construction of specially malformed repositories that could exploit this issue.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

ALT-PU-2018-2508

BDU:2018-00202

CVE-2017-17458

DLA-1224-1

DLA-1414-1

DLA-1414-2

DLA-2293-1

GHSA-6V56-CPG6-3RPX

MGASA-2018-0041

OPENSUSE-SU-2024:10586-1

PYSEC-2017-90

SUSE-SU-2018:0127-1

SUSE-SU-2018:0129-1

SUSE-SU-2018_0127-1

SUSE-SU-2018_0129-1

Produtos afetados

Alt Linux

Mercurial

Suse

Referências · 45

• https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-90.yaml · Nota
• https://github.com/dscho/hg · Nota
• https://osv.dev/vulnerability/DLA-1414-2 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-1000115 · Nota
• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17458 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-17458 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2008-2942 · Nota
• https://lists.debian.org/debian-lts-announce/2018/07/msg00041.html · Nota
• https://bugzilla.suse.com/1071715 · Nota
• https://cve.org/CVERecord?id=CVE-2017-17458 · Nota de Segurança
• https://advisories.mageia.org/MGASA-2018-0041.html · Nota de Segurança
• https://osv.dev/vulnerability/DLA-2293-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10586-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:0127-1 · Aviso do Fabricante