CVE-2017-18026 Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary comman...
HighCVSS 8.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Redmine before 3.2.9, 3.3.x before 3.3.6, and 3.4.x before 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/redmine(Debian:12) | < 3.4.4-1 | 3.4.4-1 |
| debian/redmine(Debian:13) | < 3.4.4-1 | 3.4.4-1 |
| debian/redmine(Debian:14) | < 3.4.4-1 | 3.4.4-1 |
| redmine | < 3.2.9 | 3.2.9 |
| redmine | >= 3.3.0, < 3.3.6 | 3.3.6 |
| redmine | >= 3.4.0, < 3.4.4 | 3.4.4 |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-18026 vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- DSA-4191 third-party-advisory vendor-advisory
- www.redmine.org permissions-required
- www.redmine.org vendor-advisory
- bugs.debian.org issue-tracking