CVE-2017-17458
- State
- Published
- Severity
- Not scored
- Published
- Dec 7, 2017
- Updated
- Aug 5, 2024
- Reserved
- Dec 7, 2017
Description
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [debian-lts-announce] 20171228 [SECURITY] [DLA 1224-1] mercurial security updatemailing-list
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29
- [debian-lts-announce] 20180727 [SECURITY] [DLA 1414-2] mercurial regression updatemailing-list
- [debian-lts-announce] 20180705 [SECURITY] [DLA 1414-1] mercurial security updatemailing-list
- https://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html
- 102926vdb-entry
- https://bz.mercurial-scm.org/show_bug.cgi?id=5730
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
- [debian-lts-announce] 20200731 [SECURITY] [DLA 2293-1] mercurial security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.