Bug 1479915 (CVE-2017-1000116)

Summary: CVE-2017-1000116 mercurial: command injection on clients through malicious ssh URLs
Product: [Other] Security Response Reporter: Cedric Buissart <cbuissar>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: mads, ndbecker2, pstodulk, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mercurial 4.3, mercurial 4.2.3 Doc Type: If docs needed, set a value
Doc Text:
A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a "checkout" or "update" action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-18 08:17:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1479968, 1479969, 1480455    
Bug Blocks: 1480327    

Description Cedric Buissart 2017-08-09 18:07:49 UTC 
Mercurial clients sometimes connect to URLs provided by the repository, as subrepositories, via the .hgsub file. 

A maliciously constructed ssh:// URL would cause Mercurial clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.

The vulnerability affects all clients, including those that use file://, http://, and ssh://.
Comment 1 Cedric Buissart 2017-08-09 19:42:49 UTC 
Acknowledgments:

Name: the Subversion Team
Comment 5 Cedric Buissart 2017-08-10 19:37:17 UTC 
External References:

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
Comment 6 Cedric Buissart 2017-08-11 07:37:19 UTC 
Created mercurial tracking bugs for this issue:

Affects: fedora-all [bug 1480455]
Comment 7 errata-xmlrpc 2017-08-17 11:07:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2489 https://access.redhat.com/errata/RHSA-2017:2489