CVE-2017-1000115

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2017-10-05

Last modified

2024-08-05

Weaknesses

CWE-59

Affected products

• Debian Linux (Debian)
• Mercurial (Mercurial)
• Enterprise Linux Desktop (Redhat)
• Enterprise Linux Server (Redhat)
• Enterprise Linux Server Aus (Redhat)
• Enterprise Linux Server Eus (Redhat)
• Enterprise Linux Server Tus (Redhat)
• Enterprise Linux Workstation (Redhat)

References

• http://www.debian.org/security/2017/dsa-3963
• http://www.securityfocus.com/bid/100290
• https://access.redhat.com/errata/RHSA-2017:2489
• https://security.gentoo.org/glsa/201709-18
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29