CVE-2017-17458
CriticalSummary
In Mercurial before version 4.4.1, a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script. Typical use of Mercurial prevents the construction of such repositories, but they can be created programmatically.
Risk Assessment
The organization may be exposed to the execution of malicious code, potentially leading to system and data compromise. This risk is particularly heightened if repositories are used in automation processes.
Recommendation
It is recommended to update Mercurial to version 4.4.1 or later to mitigate this vulnerability. Additionally, repositories should be monitored and verified for unauthorized scripts.
Other vulnerabilities in Mercurial
See all- CVE-2017-1000115High
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can allow malicious repositories to modify files outside the repository.
- CVE-2017-9462High
In Mercurial before version 4.1.3, the command 'hg serve --stdio' allows remote authenticated users to launch the Python debugger, consequently executing arbitrary code by using --debugger as a repository name.
- CVE-2016-3630High
The binary delta decoder in Mercurial before version 3.7.3 allows remote attackers to execute arbitrary code via (1) clone, (2) push, or (3) pull commands, related to (a) a list sizing rounding error and (b) short records.
- CVE-2016-3069High
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.
- CVE-2016-3068High
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- CVE-2014-9462High
The _validaterepo function in sshpeer in Mercurial before version 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
- CVE-2017-1000116Critical
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
Original NVD description (English source)
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.