Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Mercurial can be tricked into executing malicious commands via SSH

CVE-2017-1000116 · published 9 years ago
Summary

Mercurial versions before 4.3 allow attackers to inject malicious commands if they can trick the software into using a compromised SSH connection. This could allow the attacker to take control of the system. Update to Mercurial version 4.3 or later to fix this issue.

What to do
  • Update olivia mackall and many others mercurial to version 4.3.
  • Update mercurial mercurial to version 4.3 or later.
Affected software
Ecosystem VendorProductAffected versions
– mercurial mercurial < 4.3
cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*
– debian debian_linux 8.0
9.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
– redhat enterprise_linux_desktop 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
– redhat enterprise_linux_server 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
– redhat enterprise_linux_server_aus 7.4
7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
– redhat enterprise_linux_server_eus 7.4
7.5
7.6
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
– redhat enterprise_linux_server_tus 7.4
7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
– redhat enterprise_linux_workstation 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
pip olivia mackall and many others mercurial < 4.3
Fix: upgrade to 4.3
Original advisory text
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
6% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published5 Oct 2017
Updated22 Oct 2026
First seen6 Mar 2026
Sources
GHSA-3qmg-c9vc-r47j · GHSA
CVE-2017-1000116 · NVD
Track software like this
Free during beta