| Summary: |
<dev-vcs/mercurial-4.5.2: arbitrary command execution in mercurial repo with a git submodule |
| Product: |
Gentoo Security
|
Reporter: |
Agostino Sarubbo <ago> |
| Component: |
Vulnerabilities | Assignee: |
Gentoo Security <security> |
| Status: |
RESOLVED
FIXED
|
|
|
| Severity: |
normal
|
CC: |
glsamaker, polynomial-c
|
| Priority: |
Normal
|
Flags: |
stable-bot:
sanity-check+
|
| Version: |
unspecified | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| URL: |
https://bugzilla.redhat.com/show_bug.cgi?id=1509868
|
| Whiteboard: |
B4 [noglsa cve] |
|
Package list:
|
dev-vcs/mercurial-4.5.2
|
Runtime testing required:
|
No
|
|---|
From ${URL} : A vulnerability in Mercurial's handling of subrepositories was reported on the Mercurial Project's *public* bug tracker. The vulnerability results in arbitrary code execution during `hg clone` or `hg pull` + `hg update` if a well-crafted repository is cloned or pulled from. The vulnerability is known to occur with Git subrepositories. But it can also possibly occur with other subrepository types. The vulnerability likely impacts Mercurial versions released for the past several years. @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.