Red Hat Security AdvisoryRHSA-2017:2489
mercurial security update
Released 2017-08-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) emacs-mercurial-2.6.2-8.el7_4, emacs-mercurial-el-2.6.2-8.el7_4, mercurial-2.6.2-8.el7_4 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-mercurial-2.6.2-8.el7_4, emacs-mercurial-el-2.6.2-8.el7_4, mercurial-2.6.2-8.el7_4 +1
- Red Hat Enterprise Linux Server (v. 7) mercurial-2.6.2-8.el7_4
- Red Hat Enterprise Linux Server Optional (v. 7) emacs-mercurial-2.6.2-8.el7_4, emacs-mercurial-el-2.6.2-8.el7_4, mercurial-hgk-2.6.2-8.el7_4
- Red Hat Enterprise Linux Workstation (v. 7) mercurial-2.6.2-8.el7_4
- Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-mercurial-2.6.2-8.el7_4, emacs-mercurial-el-2.6.2-8.el7_4, mercurial-hgk-2.6.2-8.el7_4
Fixes 2 records
Priority MEDIUM 51
Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06543 · Published 2017-10-04 · Partial fix · 4.3 CWE-78
Priority MEDIUM 41
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04948 · Published 2017-10-04 · Partial fix · 4.3.1 CWE-59
