Risk | High |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2017-1000115 CVE-2017-1000116 |
CWE-ID | CWE-59 CWE-78 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Mercurial Client/Desktop applications / Other client software |
Vendor | Mercurial |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU31407
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-1000115
CWE-ID:
CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
MitigationInstall update from vendor's website.
Vulnerable software versionsMercurial: 4.0 - 4.2.3
External linkshttp://www.debian.org/security/2017/dsa-3963
http://www.securityfocus.com/bid/100290
http://access.redhat.com/errata/RHSA-2017:2489
http://security.gentoo.org/glsa/201709-18
http://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU31408
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-1000116
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
MitigationInstall update from vendor's website.
Vulnerable software versionsMercurial: 4.0 - 4.2.3
External linkshttp://www.debian.org/security/2017/dsa-3963
http://www.securityfocus.com/bid/100290
http://access.redhat.com/errata/RHSA-2017:2489
http://security.gentoo.org/glsa/201709-18
http://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.