CVE-2017-17458

Description

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

How to fix CVE-2017-17458

To remediate CVE-2017-17458, upgrade the affected package to a fixed version below.

• —upgrade to 2.2.2-4+deb7u6 or later
• —upgrade to 3.1.2-2+deb8u6 or later
• —upgrade to 4.0-1+deb9u2 or later
• —upgrade to 4.4.1-1 or later
• —upgrade to 3.1.2-2+deb8u5 or later
• —upgrade to 4.4.1 or later
• —upgrade to 4.4.1 or later

Is CVE-2017-17458 being exploited?

Moderate — EPSS is 17.2%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (7)

• from 0, < 2.2.2-4+deb7u6
• from 0, < 3.1.2-2+deb8u6
• from 0, < 4.0-1+deb9u2
• from 0, < 4.4.1-1
• from 0, < 3.1.2-2+deb8u5
• from 0, < 4.4.1
• from 0, < 4.4.1

CVSS scores

References (15)

• ADVISORYgithub.com/advisories/GHSA-6v56-cpg6-3rpx
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-17458
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-17458
• PATCHgithub.com/dscho/hg
• WEBbz.mercurial-scm.org