Описание
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
A shell command injection flaw related to the handling of "ssh" URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a "checkout" or "update" action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | mercurial | Will not fix | ||
| Red Hat Enterprise Linux 7 | mercurial | Fixed | RHSA-2017:2489 | 17.08.2017 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.3 Medium
CVSS3
Связанные уязвимости
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ...
Mercurial is vulnerable to shell injection attack
Уязвимость программного средства управления версиями Mercurial, связанная с отсутствием мер по очистке входных данных, позволяющая нарушителю выполнить произвольные команды операционной системы
EPSS
6.3 Medium
CVSS3