CVE-2017-17458
Publication date 7 December 2017
Last updated 24 July 2024
Ubuntu priority
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
From the Ubuntu Security Team
It was discovered that Mercurial incorrectly handled malformed repositories. An attacker could possibly use this issue to execute arbitrary code.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mercurial | ||
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Fixed 3.7.3-1ubuntu1.1
|
|
| 14.04 LTS trusty |
Fixed 2.8.2-1ubuntu1.4
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.8 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |