Published: 05/10/2017 Updated: 10/05/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

Vulnerable Product	Search on Vulmon	Subscribe to Product
mercurial mercurial
debian debian linux 8.0
debian debian linux 9.0
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server eus 7.6
redhat enterprise linux server tus 7.6
redhat enterprise linux server aus 7.4
redhat enterprise linux server aus 7.6
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server 7.0
redhat enterprise linux server tus 7.4

Several issues were discovered in Mercurial, a distributed revision control system CVE-2017-9462 (fixed in stretch only) Jonathan Claudius of Mozilla discovered that repositories served over stdio could be tricked into granting authorized users access to the Python debugger CVE-2017-1000115 Mercurial's symlink auditing was incomplete, ...

Debian Bug report logs - #861243 mercurial: CVE-2017-9462: allows remote users unauthorized access to a hg serve --stdio instance Package: mercurial; Maintainer for mercurial is Python Applications Packaging Team <python-apps-team@listsaliothdebianorg>; Source for mercurial is src:mercurial (PTS, buildd, popcon) Reported ...

Debian Bug report logs - #871709 mercurial: CVE-2017-1000115: path traversal via symlink Package: src:mercurial; Maintainer for src:mercurial is Python Applications Packaging Team <python-apps-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 10 Aug 2017 20:00:01 UTC Seve ...

Debian Bug report logs - #871710 mercurial: CVE-2017-1000116: command injection on clients through malicious ssh URLs Package: src:mercurial; Maintainer for src:mercurial is Python Applications Packaging Team <python-apps-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 1 ...

A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Mercurial This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a "checkout" or "update" action on a sub-repository within a malicious repository or a legitimate repository ...

A vulnerability was found in the way Mercurial handles path auditing and caches the results An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository ...

Mercurial's symlink auditing was incomplete prior to 43, and could be abused to write to files outside the repository ...

CWE-59 https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29 https://security.gentoo.org/glsa/201709-18 http://www.securityfocus.com/bid/100290 http://www.debian.org/security/2017/dsa-3963 https://access.redhat.com/errata/RHSA-2017:2489 https://nvd.nist.gov https://www.debian.org/security/./dsa-3963 https://access.redhat.com/security/cve/cve-2017-1000115

CVE-2017-1000115

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect