Bug 1479915 (CVE-2017-1000116) - CVE-2017-1000116 mercurial: command injection on clients through malicious ssh URLs
Summary: CVE-2017-1000116 mercurial: command injection on clients through malicious ss...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-1000116
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1479968 1479969 1480455
Blocks: 1480327
TreeView+ depends on / blocked
 
Reported: 2017-08-09 18:07 UTC by Cedric Buissart
Modified: 2021-02-17 01:44 UTC (History)
4 users (show)

Fixed In Version: mercurial 4.3, mercurial 4.2.3
Doc Type: If docs needed, set a value
Doc Text:
A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a "checkout" or "update" action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit.
Clone Of:
Environment:
Last Closed: 2017-08-18 08:17:48 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2489 0 normal SHIPPED_LIVE Important: mercurial security update 2017-08-17 15:06:19 UTC

Description Cedric Buissart 2017-08-09 18:07:49 UTC 
Mercurial clients sometimes connect to URLs provided by the repository, as subrepositories, via the .hgsub file. 

A maliciously constructed ssh:// URL would cause Mercurial clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.

The vulnerability affects all clients, including those that use file://, http://, and ssh://.
Comment 1 Cedric Buissart 2017-08-09 19:42:49 UTC 
Acknowledgments:

Name: the Subversion Team
Comment 5 Cedric Buissart 2017-08-10 19:37:17 UTC 
External References:

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
Comment 6 Cedric Buissart 2017-08-11 07:37:19 UTC 
Created mercurial tracking bugs for this issue:

Affects: fedora-all [bug 1480455]
Comment 7 errata-xmlrpc 2017-08-17 11:07:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2489 https://access.redhat.com/errata/RHSA-2017:2489
Note You need to log in before you can comment on or make changes to this bug.