View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2017-1000116 severity important: SUSE including 17 source package names (emacs-mercurial-2.6.2-8.el7_4, emacs-mercurial-el-2.6.2-8.el7_4, …), 33 product×package rows across 27 product lines (SUSE CaaS Platform 4.0, SUSE Enterprise Storage 6, … (27 product lines)): Fixed 19, Known Not Affected 14.
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.