Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zcG13LWg3ajQtcmY1NM4AAU_a
Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
Permalink: https://github.com/advisories/GHSA-3pmw-h7j4-rf54JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zcG13LWg3ajQtcmY1NM4AAU_a
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: 17 days ago
Identifiers: GHSA-3pmw-h7j4-rf54, CVE-2014-9462
References:
- https://nvd.nist.gov/vuln/detail/CVE-2014-9462
- https://security.gentoo.org/glsa/201612-19
- http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html
- http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html
- http://mercurial.selenic.com/wiki/WhatsNew
- http://www.debian.org/security/2015/dsa-3257
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- https://github.com/advisories/GHSA-3pmw-h7j4-rf54
Affected Packages
pypi:mercurial
Dependent packages: 15Dependent repositories: 1,767
Downloads: 62,755 last month
Affected Version Ranges: < 3.2.4
Fixed in: 3.2.4
All affected versions: 0.8.1, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 1.0.1, 1.0.2, 1.1.1, 1.1.2, 1.2.1, 1.3.1, 1.4.1, 1.4.2, 1.4.3, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.7.1, 1.7.2, 1.7.3, 1.7.5, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.9.1, 1.9.2, 1.9.3, 2.0.1, 2.0.2, 2.1.1, 2.1.2, 2.2.2, 2.4.1, 2.5.1, 2.5.2, 2.6.1, 2.6.2, 2.6.3, 2.7.0, 2.7.1, 2.7.2, 2.8.1, 2.8.2, 2.9.1, 3.0.1, 3.1.1, 3.1.2, 3.2.1, 3.2.2, 3.2.3
All unaffected versions: 3.2.4, 3.3.1, 3.3.2, 3.3.3, 3.4.1, 3.4.2, 3.5.1, 3.5.2, 3.6.1, 3.6.2, 3.6.3, 3.7.1, 3.7.2, 3.7.3, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.9.1, 3.9.2, 4.0.1, 4.0.2, 4.1.1, 4.1.2, 4.1.3, 4.2.1, 4.2.2, 4.2.3, 4.3.1, 4.3.2, 4.3.3, 4.4.1, 4.4.2, 4.5.1, 4.5.2, 4.5.3, 4.6.1, 4.6.2, 4.7.1, 4.7.2, 4.8.1, 4.8.2, 4.9.1, 5.0.1, 5.0.2, 5.1.1, 5.1.2, 5.2.1, 5.2.2, 5.3.1, 5.3.2, 5.4.1, 5.4.2, 5.5.1, 5.5.2, 5.6.1, 5.7.1, 5.8.1, 5.9.1, 5.9.2, 5.9.3, 6.0.1, 6.0.2, 6.0.3, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.2.1, 6.2.2, 6.2.3, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.5.1, 6.5.2, 6.5.3, 6.6.1, 6.6.2, 6.6.3, 6.7.1, 6.7.2, 6.7.3