CVE catalog

CVE-2017-17458

mercurial affected and fixed versions

[CVE catalog]

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

Severity
Medium · CVSS 6.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
6.33% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiemercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debiantrixiemercurial7.0.1-2Fixed[CVE-2017-17458]
Debiansidmercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debiansidmercurial7.2.4-2Fixed[CVE-2017-17458]
Debianforkymercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debianforkymercurial7.2.4-2Fixed[CVE-2017-17458]
Debianbookworm-securitymercurial6.3.2-1+deb12u1Fixed[CVE-2017-17458]
Debianbookwormmercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debianbookwormmercurial6.3.2-1+deb12u1Fixed[CVE-2017-17458]

Showing 9 fix observations. All 22 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormmercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debianbookwormmercurial6.3.2-1+deb12u1Fixed[CVE-2017-17458]
Debianbookworm-securitymercurial6.3.2-1+deb12u1Fixed[CVE-2017-17458]
Debianforkymercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debianforkymercurial7.2.4-2Fixed[CVE-2017-17458]
Debiansidmercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debiansidmercurial7.2.4-2Fixed[CVE-2017-17458]
Debiantrixiemercurial4.4.1-1FixedDistribution-reported fixed boundary[CVE-2017-17458]
Debiantrixiemercurial7.0.1-2Fixed[CVE-2017-17458]
Suselinux enterprise software development kit 11 sp4mercurial2.3.2-0.18.6.1UnknownSource applicability is not established[SUSE-SU-2018:0127-1]
Suselinux enterprise software development kit 12 sp2mercurial2.8.2-15.6.1UnknownSource applicability is not established[SUSE-SU-2018:0129-1]
Suselinux enterprise software development kit 12 sp3mercurial2.8.2-15.6.1UnknownSource applicability is not established[SUSE-SU-2018:0129-1]
Ubuntu14.04mercurial2.6.3-1UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu14.04mercurial2.7.2-1UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu14.04mercurial2.8.1-2UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu14.04mercurial2.8.2-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu14.04mercurial2.8.2-1ubuntu1.3UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu14.04mercurial2.8.2-1ubuntu1.4UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu16.04mercurial3.4-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu16.04mercurial3.6.2-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu16.04mercurial3.7.3-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Ubuntu16.04mercurial3.7.3-1ubuntu1.1UnknownSource applicability is not established[UBUNTU-CVE-2017-17458]
Original provider fields
{
  "package_releases": [
    {
      "name": "mercurial",
      "status": "fixed",
      "release": "sid",
      "version": "7.2.4-2"
    },
    {
      "name": "mercurial",
      "status": "fixed",
      "release": "forky",
      "version": "7.2.4-2"
    },
    {
      "name": "mercurial",
      "status": "fixed",
      "release": "trixie",
      "version": "7.0.1-2"
    },
    {
      "name": "mercurial",
      "status": "fixed",
      "release": "bookworm",
      "version": "6.3.2-1+deb12u1"
    },
    {
      "name": "mercurial",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "6.3.2-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "mercurial",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.1-1"
    },
    {
      "bug": null,
      "name": "mercurial",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.1-1"
    },
    {
      "bug": null,
      "name": "mercurial",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.1-1"
    },
    {
      "bug": null,
      "name": "mercurial",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.4.1-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "mercurial",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.2-0.18.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 11 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:0127-1",
      "fixed_version": "2.3.2-0.18.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:0127-1",
      "provider_updated_at": "2026-02-04T02:54:10.025822Z",
      "applicability_unknown": true
    },
    {
      "name": "mercurial",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.2-15.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 12 sp2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:0129-1",
      "fixed_version": "2.8.2-15.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:0129-1",
      "provider_updated_at": "2026-02-04T02:30:18.958547Z",
      "applicability_unknown": true
    },
    {
      "name": "mercurial",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.2-15.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 12 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:0129-1",
      "fixed_version": "2.8.2-15.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:0129-1",
      "provider_updated_at": "2026-02-04T02:30:18.958547Z",
      "applicability_unknown": true
    },
    {
      "name": "mercurial",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.8.2-1ubuntu1.4"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "2.6.3-1",
        "2.7.2-1",
        "2.8.1-2",
        "2.8.2-1ubuntu1",
        "2.8.2-1ubuntu1.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2017-17458",
      "fixed_version": "2.8.2-1ubuntu1.4",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2017-17458",
      "provider_updated_at": "2025-09-08T16:44:32Z",
      "applicability_unknown": true
    },
    {
      "name": "mercurial",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.3-1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "3.4-1ubuntu2",
        "3.6.2-1ubuntu2",
        "3.7.3-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2017-17458",
      "fixed_version": "3.7.3-1ubuntu1.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2017-17458",
      "provider_updated_at": "2025-09-08T16:44:32Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [mercurial]Unknown
    Details (4)

    • 6.3.2-1+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

    • 6.3.2-1+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

    • 6.3.2-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

    • 6.3.2-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

  • [mercurial-common]Unknown

    Source package: [mercurial]

    Details (4)

    • 6.3.2-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

    • 6.3.2-1+deb12u1 · all · bookworm

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

    • 6.3.2-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

    • 6.3.2-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · bookworm; dsa · mercurial · debian · 12

[Debian 13 (Trixie)]

  • [mercurial]Unknown
    Details (2)

    • 7.0.1-2 · amd64 · trixie

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · 13

    • 7.0.1-2 · arm64 · trixie

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · 13

  • [mercurial-common]Unknown

    Source package: [mercurial]

    Details (2)

    • 7.0.1-2 · all · trixie

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · 13

    • 7.0.1-2 · all · trixie

      Fixed · Fixed: 4.4.1-1

      dsa · mercurial · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]