Released Crucible version 4.4.3 that contains a fix for this issue.Ītlassian recommends that you upgrade to the latest version.Released Fisheye version 4.4.3 that contains a fix for this issue.Released Crucible version 4.5.1 that contains a fix for this issue.

Released Fisheye version 4.5.1 that contains a fix for this issue.

We have taken the following steps to address this issue: Click Edit Details (under 'Hg Executable').įor more information on configuring the Mercurial executable path see.Click Server (under 'Global Settings').Go to the admin area of Fisheye or Crucible.This issue can be mitigated by unconfiguring the Mercurial client executable path by following the instructions below However, if you are unable to upgrade then you can apply the following mitigation. MitigationĪtlassian recommends that you upgrade to the latest version. AcknowledgementsĪtlassian would like to credit Zhang Tianqi Tophant for reporting this issue to us. This issue can be tracked for Crucible at. This issue can be tracked for Fisheye at: . Descriptionįisheye and Crucible did not check that the name of a file in a Mercurial repository contained argument parameters. An attacker who has permission to add a repository or commit to a mercurial repository tracked by Fisheye or Crucible, can execute code of their choice on systems that run a vulnerable version of Fisheye or Crucible.Īll versions of Fisheye and Crucible before 4.4.3 (the fixed version for 4.4.x) and from 4.5.0 before 4.5.1 (the fixed version for 4.5.x) are affected by this vulnerability. This is our assessment and you should evaluate its applicability to your own IT environment. Please upgrade your Fisheye and Crucible installations immediately to fix this vulnerability.Īrgument injection in Mercurial repository handling (CVE-2017-14591) SeverityĪtlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.

Customers who have downloaded and installed Fisheye or Crucible less than version 4.4.3 (the fixed version for 4.4.x)Ĭustomers who have downloaded and installed Fisheye or Crucible >= 4.5.0 less than version 4.5.1 (the fixed version for 4.5.x)

Download the crucible 2014