Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

mercurial developers reports :

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

Security fix for CVE-2017-1000115, CVE-2017-1000116

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-18 (Mercurial: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mercurial. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a 'checkout' or 'update' action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit. (CVE-2017-1000116)

A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository.
(CVE-2017-1000115)

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in the way Mercurial handles     path auditing and caches the results. An attacker could     abuse a repository with a series of commits mixing     symlinks and regular files/directories to trick     Mercurial into writing outside of a given repository.
    (CVE-2017-1000115)

  - A shell command injection flaw related to the handling     of 'ssh' URLs has been discovered in Mercurial. This     can be exploited to execute shell commands with the     privileges of the user running the Mercurial client,     for example, when performing a 'checkout' or 'update'     action on a sub-repository within a malicious     repository or a legitimate repository containing a     malicious commit. (CVE-2017-1000116)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several issues were discovered in Mercurial, a distributed revision control system.

  - CVE-2017-9462 (fixed in stretch only)     Jonathan Claudius of Mozilla discovered that     repositories served over stdio could be tricked into     granting authorized users access to the Python debugger.

  - CVE-2017-1000115     Mercurial's symlink auditing was incomplete, and could     be abused to write files outside the repository.

  - CVE-2017-1000116     Joern Schneeweisz discovered that Mercurial did not     correctly handle maliciously constructed ssh:// URLs.
    This allowed an attacker to run an arbitrary shell     command.

Two significant vulnerabilities were found in the Mercurial version control system which could lead to shell injection attacks and out-of-tree file overwrite.

CVE-2017-1000115

Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository.

CVE-2017-1000116

Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with
-oProxyCommand. This vulnerability is similar to those in Git (CVE-2017-1000117) and Subversion (CVE-2017-9800).

For Debian 7 'Wheezy', these problems have been fixed in version 2.2.2-4+deb7u5.

We recommend that you upgrade your mercurial packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mercurial is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository.
(CVE-2017-1000115)

* A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a 'checkout' or 'update' action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit. (CVE-2017-1000116)

Red Hat would like to thank the Mercurial Security Team for reporting CVE-2017-1000115 and the Subversion Team for reporting CVE-2017-1000116.

Security Fix(es) :

  - A vulnerability was found in the way Mercurial handles     path auditing and caches the results. An attacker could     abuse a repository with a series of commits mixing     symlinks and regular files/directories to trick     Mercurial into writing outside of a given repository.
    (CVE-2017-1000115)

  - A shell command injection flaw related to the handling     of 'ssh' URLs has been discovered in Mercurial. This can     be exploited to execute shell commands with the     privileges of the user running the Mercurial client, for     example, when performing a 'checkout' or 'update' action     on a sub- repository within a malicious repository or a     legitimate repository containing a malicious commit.
    (CVE-2017-1000116)

From Red Hat Security Advisory 2017:2489 :

An update for mercurial is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository.
(CVE-2017-1000115)

* A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a 'checkout' or 'update' action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit. (CVE-2017-1000116)

Red Hat would like to thank the Mercurial Security Team for reporting CVE-2017-1000115 and the Subversion Team for reporting CVE-2017-1000116.

This update for mercurial fixes the following issues :

Mercurial was updated to 4.2.3, a security fix update for 

  - CVE-2017-1000115: Incomplete symlink auditing allowed     writing to files outside of the repository (boo#1053344)

  - CVE-2017-1000116: Client-side code execution via     argument injection in SSH URLs (boo#1052696)

Mercurial Release Notes :

CVE-2017-1000115

Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository.

CVE-2017-1000116

Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with
-oProxyCommand. This is also present in Git (CVE-2017-1000117) and Subversion (CVE-2017-9800), so please patch those tools as well if you have them installed.

New mercurial packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
103861	FreeBSD : mercurial -- multiple issues (b0628e53-092a-4037-938b-29805a7cd31b)	Nessus	FreeBSD Local Security Checks	critical
103554	Fedora 25 : mercurial (2017-fa1d8ad61a)	Nessus	Fedora Local Security Checks	critical
103446	GLSA-201709-18 : Mercurial: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103227	Amazon Linux AMI : mercurial (ALAS-2017-893)	Nessus	Amazon Linux Local Security Checks	critical
103076	EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2017-1218)	Nessus	Huawei Local Security Checks	critical
103075	EulerOS 2.0 SP1 : mercurial (EulerOS-SA-2017-1217)	Nessus	Huawei Local Security Checks	critical
102930	Debian DSA-3963-1 : mercurial - security update	Nessus	Debian Local Security Checks	critical
102886	Debian DLA-1072-1 : mercurial security update	Nessus	Debian Local Security Checks	critical
102880	CentOS 7 : mercurial (CESA-2017:2489)	Nessus	CentOS Local Security Checks	critical
102832	Fedora 26 : mercurial (2017-f03b04acbb)	Nessus	Fedora Local Security Checks	critical
102676	Scientific Linux Security Update : mercurial on SL7.x x86_64 (20170817)	Nessus	Scientific Linux Local Security Checks	critical
102575	RHEL 7 : mercurial (RHSA-2017:2489)	Nessus	Red Hat Local Security Checks	critical
102571	Oracle Linux 7 : mercurial (ELSA-2017-2489)	Nessus	Oracle Linux Local Security Checks	critical
102560	openSUSE Security Update : mercurial (openSUSE-2017-941)	Nessus	SuSE Local Security Checks	critical
102465	FreeBSD : Mercurial -- multiple vulnerabilities (1d33cdee-7f6b-11e7-a9b5-3debb10a6871)	Nessus	FreeBSD Local Security Checks	critical
102434	Slackware 14.0 / 14.1 / 14.2 / current : mercurial (SSA:2017-223-03)	Nessus	Slackware Local Security Checks	critical

Detections

Analytics

CVE-2017-1000115

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical