StackRadar

CVE-2017-17458

Critical

Advisory

Published 7 Dec 2017In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.063
93rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
68
of 17,781 indexed, latest versions
Container images
62
deployed by those charts
Fix available
2 of 2
affected packages

Mercurial vulnerable to arbitrary code injection

Carried by container images the latest versions of 68 of 17,781 indexed charts deploy, on 62 images.

Affected packageAffected versionsFixed inImages
mercurialpypi3.1.2, 3.7.3, 4.04.4.162
mercurialdeb3.1.2-2+deb8u3, 3.1.2-2+deb8u43.1.2-2+deb8u614
OSV records
GHSA-6v56-cpg6-3rpxDLA-1414-2
Also known as
PYSEC-2017-90

Charts affected

68 by stars
ChartLatestAffected imagesRadar Score
o1-botminaVerified publisher0.0.31 of 1See more

o1-bot mina 0.0.3

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
codaprotocol/coda-user-agent:0.1.54ba4dd3a041f
mercurial@4.0
4.4.1

Open the chart page →

2,655
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
moreillon/face-recognition-fastapi-front:latestc1072f4ab6aa
mercurial@4.0
4.4.1

Open the chart page →

8,556
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
openwhisk/alarmprovider:2.2.0b695a6ceb406
mercurial@4.0
4.4.1

Open the chart page →

36,215
myappp4-helm0.1.02 of 6See more

myapp p4-helm 0.1.0

2 of the 6 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
mercurial@4.0
4.4.1
fjvela/urjc-fjvela-server:1.0.53c840aebce22
mercurial@4.0
4.4.1

Open the chart page →

19,720
practica-helmpractica-helm0.1.01 of 7See more

practica-helm practica-helm 0.1.0

1 of the 7 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
slagattollas/server-practica:latest6dd8ead8e2b1
mercurial@4.0
4.4.1

Open the chart page →

28,484
classificationsignalen4.24.01 of 1See more

classification signalen 4.24.0

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
signalen/classification:ad60447d1733473e30ab0a3ba53d58141cc1d2509496ae672877
mercurial@4.0
4.4.1

Open the chart page →

1,553
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
mercurial@4.0
4.4.1

Open the chart page →

3,696
simple-db-app-chartsimple-db-app0.1.01 of 2See more

simple-db-app-chart simple-db-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
htmlprogrammer2001/simple-db-app:1.0a7e0a233a9bc
mercurial@4.0
4.4.1

Open the chart page →

1,925
simple-db-app-chart-with-dependencysimple-db-app0.1.01 of 3See more

simple-db-app-chart-with-dependency simple-db-app 0.1.0

1 of the 3 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
htmlprogrammer2001/simple-db-app:1.0a7e0a233a9bc
mercurial@4.0
4.4.1

Open the chart page →

1,925
first-appsimple-helm-chart0.1.01 of 1See more

first-app simple-helm-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
leeyoongti/first-app:1.0.021d66cb76352
mercurial@4.0
4.4.1

Open the chart page →

2,154
restful-distributed-lock-managerstakaterVerified publisher1.0.41 of 1See more

restful-distributed-lock-manager stakater 1.0.4

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
stakater/restful-distributed-lock-manager:0.5.34f8e409f30c2
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6

Open the chart page →

3,116
sonarqubestakaterVerified publisher0.10.31 of 2See more

sonarqube stakater 0.10.3

1 of the 2 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
library/sonarqube:6.7.6-community0ae5169e3d0f
mercurial@4.0
4.4.1

Open the chart page →

11,841
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
mercurial@4.0
4.4.1

Open the chart page →

4,967
voteappvoting-app-helm-charts-repoVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo 1.0.0

1 of the 5 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.4.1

Open the chart page →

8,262
workerappvoting-app-helm-charts-repoVerified publisher1.0.01 of 1See more

workerapp voting-app-helm-charts-repo 1.0.0

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.4.1

Open the chart page →

3,329
voteappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 5See more

voteapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 5 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.4.1

Open the chart page →

8,262
workerappvoting-app-helm-charts-repo-cloudVerified publisher1.0.01 of 1See more

workerapp voting-app-helm-charts-repo-cloud 1.0.0

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.4.1

Open the chart page →

3,329
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2017-17458.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
mercurial@4.0
4.4.1

Open the chart page →

2,559

Container images carrying it

62 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
kodekloud/examplevotingapp_worker:v1741e3aaaa812
mercurial@4.0
4.4.1
4
oscarsotosanchez/server:v1.06e2e1279126b
mercurial@4.0
4.4.1
4
fjvela/urjc-fjvela-external-service:1.0.1a8ebe5ca13fc
mercurial@4.0
4.4.1
2
fjvela/urjc-fjvela-server:1.0.53c840aebce22
mercurial@4.0
4.4.1
2
htmlprogrammer2001/simple-db-app:1.0a7e0a233a9bc
mercurial@4.0
4.4.1
2
moreillon/api-proxy:a3e8b41e9e578c9653b6
mercurial@4.0
4.4.1
2
nachomillangarcia/prometheus_aws_cost_exporter:lateste4ce056f2d6d
mercurial@4.0
4.4.1
2
neilpeterson/azure-vote-front:v384062718347c
mercurial@4.0
4.4.1
2
statsd/statsd:v0.8.6dab129e74c25
mercurial@4.0
4.4.1
2
a5huynh/oauth2_proxy:2.20c7307d31ca8
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.4.1
3.1.2-2+deb8u6
1
amancevice/superset:0.28.1c8c04bfe3d66
mercurial@4.0
4.4.1
1
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.4.1
3.1.2-2+deb8u6
1
billimek/comcastusage-for-influxdb:latest801bba1228ac
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
bryanalves/honeywell_exporter:0.0.1195f73dce8b21
mercurial@4.0
4.4.1
1
bryanalves/smart_exporter:0.2af47dfbb9413
mercurial@4.0
4.4.1
1
camptocamp/imap-mailbox-exporter:latest9dec019e4c62
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.4.1
3.1.2-2+deb8u6
1
camptocamp/ldap-search-exporter:latest5e55370dd292
mercurial@3.1.2
mercurial@3.1.2-2+deb8u3
4.4.1
3.1.2-2+deb8u6
1
codaprotocol/buildkite-exporter:0.2.137c68e67a401
mercurial@4.0
4.4.1
1
codaprotocol/coda-user-agent:0.1.54ba4dd3a041f
mercurial@4.0
4.4.1
1
davidvmar/urjc-davidvmar-external-service:1.0.02a68e9ac7f09
mercurial@4.0
4.4.1
1
davidvmar/urjc-davidvmar-server:1.0.05663f5b24615
mercurial@4.0
4.4.1
1
egdsandaru/apache-ranger-admin:1.0.0681baa1926f4
mercurial@4.0
4.4.1
1
enketo/enketo-express:3.0.4dcad9c2273f6
mercurial@4.0
4.4.1
1
ethersphere/bzz-token-service:latest7624f11a72ad
mercurial@4.0
4.4.1
1
fiware/bae-activation-service:v0.0.33e3ec88d59ed
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
galaxy/galaxy-init:v18.010267bad550e6
mercurial@3.7.3
4.4.1
1
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
mercurial@4.0
4.4.1
1
halkeye/slack-resurrect:v0.1.477b05e95fdb5
mercurial@4.0
4.4.1
1
hickey/puppet_forge:1.10.0c1148a09ef20
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
i4trust/pdc-portal:2.0.03e77858e1219
mercurial@4.0
4.4.1
1
jenkinsci/jenkins:2.67a1f33f004659
mercurial@4.0
4.4.1
1
leeyoongti/first-app:1.0.021d66cb76352
mercurial@4.0
4.4.1
1
library/sonarqube:6.7.6-community0ae5169e3d0f
mercurial@4.0
4.4.1
1
moreillon/face-recognition-fastapi-front:latestc1072f4ab6aa
mercurial@4.0
4.4.1
1
mvitale1989/docker-taiga:20191031-4.2.141504ccda06df
mercurial@4.0
4.4.1
1
neilpeterson/aks-helloworld:v1fb47732ef36b
mercurial@4.0
4.4.1
1
neilpeterson/burst-scheduler:v1.23a8877032972
mercurial@4.0
4.4.1
1
neilpeterson/chart-tweet:latest64fd8dab075f
mercurial@4.0
4.4.1
1
neilpeterson/get-tweet:v28b645ac1a23e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
neilpeterson/osba-container-instances-demo:latest6527b05d5d03
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
neilpeterson/osba-cosmos-mongodb-demo:latestf4940e84ed05
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
neilpeterson/osba-mysql-demo:latest5859d68a6c9f
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
neilpeterson/osba-storage-demo:latest29d229ab446e
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
neilpeterson/osba-text-analytics-demo:latest969af3cb8466
mercurial@3.1.2
mercurial@3.1.2-2+deb8u4
4.4.1
3.1.2-2+deb8u6
1
neilpeterson/process-tweet:latest39ce9f92e899
mercurial@4.0
4.4.1
1
nodered/node-red-docker:0.19.6-v8070643219ea2
mercurial@4.0
4.4.1
1
ondrejsika/parking:latestb1fd497416c8
mercurial@4.0
4.4.1
1
openwhisk/alarmprovider:2.2.0b695a6ceb406
mercurial@4.0
4.4.1
1
pachyderm/grpc-proxy:0.4.92b27f41d4d02
mercurial@4.0
4.4.1
1
rakii8585/angular-node-webapp:latest026082a515ac
mercurial@4.0
4.4.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.