CVE-2016-3105 Mercurial vulnerable to arbitrary code execution when converting Git repos

High 8.8 Published 9 May 2016 Updated 5 Aug 2024

Attackers can execute arbitrary code via a crafted git repository name in the Mercurial convert extension.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2016-3105?

CVE-2016-3105 is a high-severity code injection vulnerability in Debian Debian Linux, published on 9 May 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.

Weakness: CWE-284

Which versions are affected by CVE-2016-3105?

3 open source packages ship an affected version, including mercurial. It affects 2 products.

Package	Affected	Fixed in
`mercurial` PyPI	All versions	`3.8`
`mercurial` PyPI	All versions	`3.8`
`mercurial` PyPI	All versions	`3.8-rc`

Linux distribution packages (3)

`mercurial` SUSE:Linux Enterprise Software Development Kit 11 SP4	All versions	`2.3.2-0.14.2`
`mercurial` SUSE:Linux Enterprise Software Development Kit 12	All versions	`2.8.2-9.1`
`mercurial` SUSE:Linux Enterprise Software Development Kit 12 SP1	All versions	`2.8.2-9.1`

Products include Debian Debian Linux, Mercurial Mercurial.

How do I fix CVE-2016-3105?

Upgrade mercurial to a fixed version for your release line: 3.8 or 3.8-rc.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2016-3105 being exploited?

There is no known exploitation of CVE-2016-3105 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2016-3105, DLA-459-1, DSA-3570-1, GHSA-49cw-434h-qc57, MGASA-2016-0172, PYSEC-2016-28 and 3 more.