CVE-2017-17458
Publication date 7 December 2017
Last updated 25 August 2025
Ubuntu priority
Description
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
From the Ubuntu Security Team
It was discovered that Mercurial incorrectly handled malformed repositories. An attacker could possibly use this issue to execute arbitrary code.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mercurial | ||
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Fixed 3.7.3-1ubuntu1.1
|
|
| 14.04 LTS trusty |
Fixed 2.8.2-1ubuntu1.4
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H