CVE-2017-1000115: High severity mercurial vulnerability
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
Other sources
The symlink auditor is sometimes cached too long, and can be confused into allowing write access to outside the repo.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000115?
CVE-2017-1000115 is classified as a moderate severity vulnerability due to the potential for unintended file modifications in malicious repositories.
How do I fix CVE-2017-1000115?
To fix CVE-2017-1000115, update Mercurial to version 4.3 or later, or to version 4.2.3 if using an older release.
What systems are affected by CVE-2017-1000115?
CVE-2017-1000115 affects Mercurial versions prior to 4.3 on various Linux distributions including Red Hat and Debian.
What type of attack can CVE-2017-1000115 enable?
CVE-2017-1000115 can allow a malicious repository to modify files outside of the intended directory by exploiting the missing symlink check.
Is CVE-2017-1000115 a remote or local vulnerability?
CVE-2017-1000115 can be exploited remotely as it involves malicious repositories that can affect local file systems.