Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 533008 - <dev-vcs/mercurial-3.2.3: vulnerability on case-insensitive file systems (CVE-2014-9390)
Summary: <dev-vcs/mercurial-3.2.3: vulnerability on case-insensitive file systems (CVE...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://mercurial.selenic.com/wiki/Wha...
Whiteboard: B2 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-19 09:31 UTC by Dirkjan Ochtman (RETIRED)
Modified: 2016-12-07 10:36 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dirkjan Ochtman (RETIRED) gentoo-dev 2014-12-19 09:31:33 UTC
I haven't found any clear description. A similar problem exists in git (bug 532984).
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2014-12-19 19:44:54 UTC
+*mercurial-3.2.3 (19 Dec 2014)
+
+  19 Dec 2014; Lars Wendler <polynomial-c@gentoo.org> -mercurial-3.1.1.ebuild,
+  -mercurial-3.2.ebuild, +mercurial-3.2.3.ebuild:
+  Security bump (bug #533008). Removed old.
+
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2014-12-19 23:15:39 UTC
Setting Whiteboard.

Also reference for the vulnerability is here:
http://git-blame.blogspot.com/2014/12/git-1856-195-205-214-and-221-and.html

Maintainers, please advise when ebuilds have had enough testing, and are ready for stabilization.
Comment 3 Dirkjan Ochtman (RETIRED) gentoo-dev 2014-12-22 18:18:08 UTC
Let's stabilize all of these:

=dev-vcs/mercurial-2.3.2
=dev-vcs/hgsubversion-1.7
=dev-vcs/hg-git-0.7.0

(The latter two only on amd64 and x86.)
Comment 4 Agostino Sarubbo gentoo-dev 2014-12-23 09:02:56 UTC
amd64 stable
Comment 5 Agostino Sarubbo gentoo-dev 2014-12-23 09:04:11 UTC
x86 stable
Comment 6 Jeroen Roovers (RETIRED) gentoo-dev 2014-12-23 13:06:30 UTC
Stable for HPPA.
Comment 7 Agostino Sarubbo gentoo-dev 2014-12-24 14:38:45 UTC
ppc stable
Comment 8 Agostino Sarubbo gentoo-dev 2014-12-24 14:48:51 UTC
ppc64 stable
Comment 9 Yury German Gentoo Infrastructure gentoo-dev 2014-12-24 14:50:00 UTC
Just to correct this to make sure:
=dev-vcs/mercurial-3.2.3
Comment 10 Agostino Sarubbo gentoo-dev 2014-12-25 11:21:41 UTC
ia64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2014-12-26 09:20:45 UTC
sparc stable
Comment 12 Markus Meier gentoo-dev 2014-12-30 17:50:05 UTC
arm stable
Comment 13 Tobias Klausmann (RETIRED) gentoo-dev 2015-01-09 10:52:58 UTC
dev-vcs/mercurial-3.2.3 stable on alpha.
Comment 14 Yury German Gentoo Infrastructure gentoo-dev 2015-01-15 22:47:44 UTC
Arches and Maintainer(s), Thank you for your work.

New GLSA request filed.
Comment 15 GLSAMaker/CVETool Bot gentoo-dev 2016-12-07 10:36:28 UTC
This issue was resolved and addressed in
 GLSA 201612-19 at https://security.gentoo.org/glsa/201612-19
by GLSA coordinator Aaron Bauman (b-man).