Bug 1479915 - (CVE-2017-1000116) CVE-2017-1000116 mercurial: command injection on clients through malicious ssh URLs
CVE-2017-1000116 mercurial: command injection on clients through malicious ss...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170810,repo...
: Security
Depends On: 1479969 1479968 1480455
Blocks: 1480327
  Show dependency treegraph
 
Reported: 2017-08-09 14:07 EDT by Cedric Buissart
Modified: 2017-08-18 04:17 EDT (History)
4 users (show)

See Also:
Fixed In Version: mercurial 4.3, mercurial 4.2.3
Doc Type: If docs needed, set a value
Doc Text:
A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a "checkout" or "update" action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-18 04:17:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Cedric Buissart 2017-08-09 14:07:49 EDT
Mercurial clients sometimes connect to URLs provided by the repository, as subrepositories, via the .hgsub file. 

A maliciously constructed ssh:// URL would cause Mercurial clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.

The vulnerability affects all clients, including those that use file://, http://, and ssh://.
Comment 1 Cedric Buissart 2017-08-09 15:42:49 EDT
Acknowledgments:

Name: the Subversion Team
Comment 5 Cedric Buissart 2017-08-10 15:37:17 EDT
External References:

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
Comment 6 Cedric Buissart 2017-08-11 03:37:19 EDT
Created mercurial tracking bugs for this issue:

Affects: fedora-all [bug 1480455]
Comment 7 errata-xmlrpc 2017-08-17 07:07:00 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2489 https://access.redhat.com/errata/RHSA-2017:2489

Note You need to log in before you can comment on or make changes to this bug.