Red Hat Security AdvisoryRHSA-2017:1576
mercurial security update
Released 2017-06-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) emacs-mercurial-2.6.2-7.el7_3, emacs-mercurial-el-2.6.2-7.el7_3, mercurial-2.6.2-7.el7_3 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-mercurial-2.6.2-7.el7_3, emacs-mercurial-el-2.6.2-7.el7_3, mercurial-2.6.2-7.el7_3 +1
- Red Hat Enterprise Linux Desktop Optional (v. 6) emacs-mercurial-1.4-5.el6_9, emacs-mercurial-el-1.4-5.el6_9, mercurial-1.4-5.el6_9 +1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) emacs-mercurial-1.4-5.el6_9, emacs-mercurial-el-1.4-5.el6_9, mercurial-1.4-5.el6_9 +1
- Red Hat Enterprise Linux Server (v. 6) mercurial-1.4-5.el6_9
- Red Hat Enterprise Linux Server (v. 7) mercurial-2.6.2-7.el7_3
- Red Hat Enterprise Linux Server Optional (v. 6) emacs-mercurial-1.4-5.el6_9, emacs-mercurial-el-1.4-5.el6_9, mercurial-hgk-1.4-5.el6_9
- Red Hat Enterprise Linux Server Optional (v. 7) emacs-mercurial-2.6.2-7.el7_3, emacs-mercurial-el-2.6.2-7.el7_3, mercurial-hgk-2.6.2-7.el7_3
- Red Hat Enterprise Linux Workstation (v. 6) mercurial-1.4-5.el6_9
- Red Hat Enterprise Linux Workstation (v. 7) mercurial-2.6.2-7.el7_3
- Red Hat Enterprise Linux Workstation Optional (v. 6) emacs-mercurial-1.4-5.el6_9, emacs-mercurial-el-1.4-5.el6_9, mercurial-hgk-1.4-5.el6_9
- Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-mercurial-2.6.2-7.el7_3, emacs-mercurial-el-2.6.2-7.el7_3, mercurial-hgk-2.6.2-7.el7_3
Fixes 1 record
Priority MEDIUM 58
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.21685 · Published 2017-06-06 · Fixed in 4.1.3 CWE-732
