CVE-2017-17458: Mercurial vulnerable to arbitrary code injection
(updated )
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
References
- bz.mercurial-scm.org/show_bug.cgi?id=5730
- confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
- github.com/advisories/GHSA-6v56-cpg6-3rpx
- github.com/dscho/hg
- github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-90.yaml
- lists.debian.org/debian-lts-announce/2017/12/msg00027.html
- lists.debian.org/debian-lts-announce/2018/07/msg00005.html
- lists.debian.org/debian-lts-announce/2018/07/msg00041.html
- lists.debian.org/debian-lts-announce/2020/07/msg00032.html
- nvd.nist.gov/vuln/detail/CVE-2017-17458
- web.archive.org/web/20200227132808/http://www.securityfocus.com/bid/102926
- www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html
- www.mercurial-scm.org/wiki/WhatsNew
Code Behaviors & Features
Detect and mitigate CVE-2017-17458 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →