CVE-2017-1000115

EUVD-2017-0070
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
mercurialmercurial
𝑥
< 4.3
debiandebian_linux
8.0
debiandebian_linux
9.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_aus
7.6
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_server_eus
7.6
redhatenterprise_linux_server_tus
7.4
redhatenterprise_linux_server_tus
7.6
redhatenterprise_linux_workstation
7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mercurial
bookworm
6.3.2-1
fixed
bullseye
5.6.1-4
fixed
sid
6.8.2-1
fixed
trixie
6.8.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mercurial
artful
Fixed 4.3.1-2
released
bionic
not-affected
cosmic
not-affected
trusty
Fixed 2.8.2-1ubuntu1.4
released
xenial
Fixed 3.7.3-1ubuntu1.1
released
zesty
ignored
Common Weakness Enumeration
References
http://www.debian.org/security/2017/dsa-3963
http://www.securityfocus.com/bid/100290
https://access.redhat.com/errata/RHSA-2017:2489
https://security.gentoo.org/glsa/201709-18
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
http://www.debian.org/security/2017/dsa-3963
http://www.securityfocus.com/bid/100290
https://access.redhat.com/errata/RHSA-2017:2489
https://security.gentoo.org/glsa/201709-18
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29