CVE-2017-1000116

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-10-05

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• Debian Linux (Debian)
• Mercurial (Mercurial)
• Enterprise Linux Desktop (Redhat)
• Enterprise Linux Server (Redhat)
• Enterprise Linux Server Aus (Redhat)
• Enterprise Linux Server Eus (Redhat)
• Enterprise Linux Server Tus (Redhat)
• Enterprise Linux Workstation (Redhat)

References

• http://www.debian.org/security/2017/dsa-3963
• http://www.securityfocus.com/bid/100290
• https://access.redhat.com/errata/RHSA-2017:2489
• https://security.gentoo.org/glsa/201709-18
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29