CVE-2017-1000116: OS Command Injection
Mercurial clients sometimes connect to URLs provided by the repository, as subrepositories, via the .hgsub file.
A maliciously constructed ssh:// URL would cause Mercurial clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.
The vulnerability affects all clients, including those that use file://, http://, and ssh://.
Other sources
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000116?
CVE-2017-1000116 has a medium severity rating due to the potential for shell-injection attacks.
How do I fix CVE-2017-1000116?
To resolve CVE-2017-1000116, upgrade Mercurial to version 4.3 or later.
Which versions of Mercurial are affected by CVE-2017-1000116?
CVE-2017-1000116 affects Mercurial versions prior to 4.3.
Can CVE-2017-1000116 be exploited through subrepositories?
Yes, CVE-2017-1000116 can be exploited through malicious ssh URL inputs in the .hgsub file.
Is there a workaround for CVE-2017-1000116?
A workaround for CVE-2017-1000116 includes avoiding the use of untrusted .hgsub files until an upgrade can be performed.