PT-2017-3011 · Mercurial+5 · Mercurial+5
Published
2017-08-17
·
Updated
2025-11-14
·
CVE-2017-1000116
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Mercurial versions prior to 4.3
git-annex versions prior to 6.20170818
Description
The issue is related to inadequate sanitization of hostnames passed to ssh, leading to possible shell-injection attacks. This could allow a remote attacker to execute arbitrary commands on the operating system. The vulnerability can be exploited by tricking the victim into adding a remote repository with a malicious SSH hostname, such as
ssh://-eProxyCommand=evil/blah. The attacker could also use initremote with an SSH remote to embed the malicious URL in the git-annex branch.Recommendations
For Mercurial versions prior to 4.3, update to version 4.3 or later to resolve the issue.
For git-annex versions prior to 6.20170818, update to version 6.20170818 or later to resolve the issue.
As a temporary workaround, consider restricting the use of SSH hostnames to trusted sources until a patch is available.
Avoid using malicious SSH hostnames, such as those starting with a dash, to prevent arbitrary local code execution.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Mercurial
Red Hat
Suse
Git-Annex