PT-2017-3414 · Mercurial+2 · Mercurial+2

Zhang Tianqi · Published 2017-11-02 · Updated 2024-06-15 · CVE-2017-17458

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.4.1

Description The issue is related to the execution of arbitrary code through a specially malformed repository. This can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. The typical use of Mercurial prevents the construction of such repositories, but they can be created programmatically.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the creation of repositories to prevent the construction of specially malformed repositories that could exploit this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2018-2508

BDU:2018-00202

CVE-2017-17458

DLA-1224-1

DLA-1414-1

DLA-1414-2

DLA-2293-1

GHSA-6V56-CPG6-3RPX

MGASA-2018-0041

OPENSUSE-SU-2024:10586-1

PYSEC-2017-90

SUSE-SU-2018:0127-1

SUSE-SU-2018:0129-1

SUSE-SU-2018_0127-1

SUSE-SU-2018_0129-1

Affected Products

Alt Linux

Mercurial

Suse

References · 45

• https://osv.dev/vulnerability/DLA-1414-2 · Vendor Advisory
• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-17458 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-17458 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17458 · Security Note
• https://advisories.mageia.org/MGASA-2018-0041.html · Security Note
• https://osv.dev/vulnerability/DLA-2293-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10586-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0127-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-90 · Vendor Advisory
• https://mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-17458 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1414-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00202 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0041 · Vendor Advisory