critique
CVE-2017-1000116
mercurial: command injection on clients through malicious ssh URLs
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat6.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Photon OS. Plus basse selon Red Hat (élevée), Amazon (élevée), Oracle (élevée), Ubuntu (moyenne).
Description
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | mercurial | 4.3.3-1.ph1 |
| Photon OS 2.0 | mercurial | 4.3.3-1.ph2 |
| pip::GitHub Security Advisory pip | mercurial | 4.3 |
| alpine 3.3 | mercurial | 4.3.1-r0 |
| alpine 3.4 | mercurial | 4.3.1-r0 |
| alpine 3.5 | mercurial | 4.3.1-r0 |
| alpine 3.6 | mercurial | 4.3.1-r0 |
| amazon linux 1 | emacs-mercurial, emacs-mercurial-el, mercurial-common et 3 autres | 4.2.3-1.29.amzn1 |
| debian 11 | mercurial | 4.3.1-1 |
| debian 12 | mercurial | 4.3.1-1 |
| debian 13 | mercurial | 4.3.1-1 |
| debian 14 | mercurial | 4.3.1-1 |
Afficher les 34 entrées de 23 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Photon OS 1.0 | mercurial | 4.3.3-1.ph1 |
| Photon OS 2.0 | mercurial | 4.3.3-1.ph2 |
| pip::GitHub Security Advisory pip | mercurial | 4.3 |
| alpine 3.3 | mercurial | 4.3.1-r0 |
| alpine 3.4 | mercurial | 4.3.1-r0 |
| alpine 3.5 | mercurial | 4.3.1-r0 |
| alpine 3.6 | mercurial | 4.3.1-r0 |
| amazon linux 1 | emacs-mercurial | 4.2.3-1.29.amzn1 |
| amazon linux 1 | emacs-mercurial-el | 4.2.3-1.29.amzn1 |
| amazon linux 1 | mercurial-common | 4.2.3-1.29.amzn1 |
| amazon linux 1 | mercurial-debuginfo | 4.2.3-1.29.amzn1 |
| amazon linux 1 | mercurial-python26 | 4.2.3-1.29.amzn1 |
| amazon linux 1 | mercurial-python27 | 4.2.3-1.29.amzn1 |
| debian 11 | mercurial | 4.3.1-1 |
| debian 12 | mercurial | 4.3.1-1 |
| debian 13 | mercurial | 4.3.1-1 |
| debian 14 | mercurial | 4.3.1-1 |
| debian 7 | mercurial | 2.2.2-4+deb7u5 |
| debian 8 | mercurial | 3.1.2-2+deb8u4 |
| debian 9 | mercurial | 4.0-1+deb9u1 |
| echo | mercurial | 4.3.1-1 |
| Oracle Linux 7 | emacs-mercurial | 2.6.2-8.el7_4 |
| Oracle Linux 7 | emacs-mercurial-el | 2.6.2-8.el7_4 |
| Oracle Linux 7 | mercurial | 2.6.2-8.el7_4 |
| Oracle Linux 7 | mercurial-hgk | 2.6.2-8.el7_4 |
| Red Hat | emacs-mercurial | pas de correctif indiqué |
| Red Hat | emacs-mercurial-el | pas de correctif indiqué |
| Red Hat | mercurial | pas de correctif indiqué |
| Red Hat | mercurial-hgk | pas de correctif indiqué |
| ubuntu 14.04 | mercurial | 2.8.2-1ubuntu1.4 |
| ubuntu 14.04-ESM | mercurial | 2.8.2-1ubuntu1.4 |
| ubuntu 16.04 | mercurial | 3.7.3-1ubuntu1.1 |
| ubuntu 16.04-ESM | mercurial | 3.7.3-1ubuntu1.1 |
| ubuntu 17.10 | mercurial | 4.3.1-2 |
Références
- http://www.debian.org/security/2017/dsa-3963
- http://www.securityfocus.com/bid/100290
- https://access.redhat.com/errata/RHSA-2017:2489
- https://access.redhat.com/security/cve/CVE-2017-1000116
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-89.yaml
- https://linux.oracle.com/cve/CVE-2017-1000116.html
- https://linux.oracle.com/errata/ELSA-2017-2489.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000116
Les 25 références
- https://security.gentoo.org/glsa/201709-18
- https://web.archive.org/web/20200227155758/http://www.securityfocus.com/bid/100290
- https://wiki.mercurial-scm.org/WhatsNew/Archive
- https://www.cve.org/CVERecord?id=CVE-2017-1000116
- https://www.mercurial-scm.org/repo/hg/rev/00a75672a9cb
- https://www.mercurial-scm.org/repo/hg/rev/08cfc4baf3ba
- https://www.mercurial-scm.org/repo/hg/rev/173ecccb9ee7
- https://www.mercurial-scm.org/repo/hg/rev/53224b1ffbc2
- https://www.mercurial-scm.org/repo/hg/rev/55681baf4cf9
- https://www.mercurial-scm.org/repo/hg/rev/92b583e3e522
- https://www.mercurial-scm.org/repo/hg/rev/943c91326b23
- https://www.mercurial-scm.org/repo/hg/rev/ca398a50ca00
- https://www.mercurial-scm.org/repo/hg/rev/e10745311406
- https://www.mercurial-scm.org/repo/hg/rev/f9134e96ed0f
- https://www.mercurial-scm.org/repo/hg/rev/f93975a5ebe8
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.282017-08-10.29
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29