Unscored CVE-2017-17536 EUVD-2017-8696GHSA-j2x8-qgjm-w8gp

Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers t…

Published Dec 11, 2017 · Updated Sep 16, 2024 · Assigned by mitre

Package: phabricator Package: phabricator Ecosystem: Debian Ecosystem: Ubuntu

Description

Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	phabricator	No fix yet	—

Ubuntu