CVE-2018-17983

Vulnerability

In Mercurial versions before 4.7.2, the cext/manifest.c file contains an out-of-bounds read vulnerability. The bug occurs during the parsing of a specially crafted manifest entry, where the code does not properly validate the length of the input before reading memory. Affected versions include all Mercurial releases prior to 4.7.2, as documented in the project's release notes [1].

Exploitation

An attacker can exploit this vulnerability by providing a malicious manifest entry to a repository that is then parsed by Mercurial. The attacker does not require any special authentication or network position, as the malformed entry can be introduced through a crafted commit or repository that a victim clones or pulls. The out-of-bounds read occurs automatically when the manifest is parsed during operations such as hg log, hg update, or other commands that process repository history [2][3].

Impact

Successful exploitation allows the attacker to cause an out-of-bounds read, which may lead to information disclosure of sensitive data from memory or a crash (denial of service). The impact is limited to read access beyond the intended buffer; there is no evidence of arbitrary code execution from this bug alone. The vulnerability affects the integrity of the manifest parsing process [2][3].

Mitigation

Mercurial 4.7.2 was released on 2018-10-01 and contains the fix for this vulnerability [1]. Users should upgrade to version 4.7.2 or later. The fix is available in the Mercurial repository (revision 5405cb1a7901) [4]. No workarounds are documented for unpatched versions; upgrading is the only mitigation.