logo

Database

Remote command execution In mercurial

Description

Mercurial vulnerable to arbitrary code injection In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2017-174582. NVD-2017-174583. OSV-DEBIAN-2017-174584. OSV-2017-174585. GCVE-2017-174586. SECURITY-TRACKER-CVE-2017-174587. lists.debian.org8. lists.debian.org9. lists.debian.org10. lists.debian.org

References

1. https://bz.mercurial-scm.org/show_bug.cgi?id=57302. https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html3. https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-90.yaml4. https://web.archive.org/web/20200227132808/http://www.securityfocus.com/bid/1029265. https://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html6. https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.