Description
In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://lists.debian.org/debian-lts-announce/2017/12/msg00027.html ↗
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29 ↗
- https://lists.debian.org/debian-lts-announce/2018/07/msg00041.html ↗
- https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html ↗
- https://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html ↗
- http://www.securityfocus.com/bid/102926 ↗
- https://bz.mercurial-scm.org/show_bug.cgi?id=5730 ↗
- https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html ↗
- https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html ↗