CVE-2017-17458
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 6.3%
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
Produtos afetados
n/a · n/aReferências
https://bz.mercurial-scm.org/show_bug.cgi?id=5730https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.htmlhttps://lists.debian.org/debian-lts-announce/2017/12/msg00027.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2018/07/msg00041.htmlhttps://lists.debian.org/debian-lts-announce/2020/07/msg00032.htmlhttps://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.htmlhttps://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29http://www.securityfocus.com/bid/102926