The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

An update of the mercurial package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mercurial: arbitrary command execution in mercurial repo with a git submodule (CVE-2017-17458)

  - mercurial: Buffer underflow in mpatch.c:mpatch_apply() (CVE-2018-13347)

  - Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote     attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle     attack. (CVE-2010-4237)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2276 advisory.

    - Add missing hunk for CVE-2018-13347 patch
    - Related: CVE-2018-13347

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in mercurial, an easy-to-use, scalable distributed version control system.

CVE-2017-17458

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository.
Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE-2018-13346

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data.

CVE-2018-13347

mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction.

CVE-2018-13348

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not.

CVE-2018-1000132

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

CVE-2019-3902

Symbolic links and subrepositories could be used defeat Mercurial's path-checking logic and write files outside the repository root.

For Debian 9 stretch, these problems have been fixed in version 4.0-1+deb9u2.

We recommend that you upgrade your mercurial packages.

For the detailed security status of mercurial please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mercurial

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The mpatch_apply function in mpatch.c in Mercurial     before 4.6.1 incorrectly proceeds in cases where the     fragment start is past the end of the original data,     aka OVE-20180430-0004.(CVE-2018-13346)

  - mpatch.c in Mercurial before 4.6.1 mishandles integer     addition and subtraction, aka     OVE-20180430-0002.(CVE-2018-13347)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mercurial packages installed that are affected by multiple vulnerabilities:

  - Mercurial version 4.5 and earlier contains a Incorrect     Access Control (CWE-285) vulnerability in Protocol     server that can result in Unauthorized data access. This     attack appear to be exploitable via network     connectivity. This vulnerability appears to have been     fixed in 4.5.1. (CVE-2018-1000132)

  - The mpatch_apply function in mpatch.c in Mercurial     before 4.6.1 incorrectly proceeds in cases where the     fragment start is past the end of the original data, aka     OVE-20180430-0004. (CVE-2018-13346)

  - mpatch.c in Mercurial before 4.6.1 mishandles integer     addition and subtraction, aka OVE-20180430-0002.
    (CVE-2018-13347)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mercurial packages installed that are affected by multiple vulnerabilities:

  - Mercurial version 4.5 and earlier contains a Incorrect     Access Control (CWE-285) vulnerability in Protocol     server that can result in Unauthorized data access. This     attack appear to be exploitable via network     connectivity. This vulnerability appears to have been     fixed in 4.5.1. (CVE-2018-1000132)

  - The mpatch_apply function in mpatch.c in Mercurial     before 4.6.1 incorrectly proceeds in cases where the     fragment start is past the end of the original data, aka     OVE-20180430-0004. (CVE-2018-13346)

  - mpatch.c in Mercurial before 4.6.1 mishandles integer     addition and subtraction, aka OVE-20180430-0002.
    (CVE-2018-13347)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for mercurial is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* mercurial: Buffer underflow in mpatch.c:mpatch_apply() (CVE-2018-13347)

* mercurial: HTTP server permissions bypass (CVE-2018-1000132)

* mercurial: Missing check for fragment start position in mpatch.c:mpatch_apply() (CVE-2018-13346)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - mercurial: Buffer underflow in mpatch.c:mpatch_apply()     (CVE-2018-13347)

  - mercurial: HTTP server permissions bypass     (CVE-2018-1000132)

  - mercurial: Missing check for fragment start position in     mpatch.c:mpatch_apply() (CVE-2018-13346)

This update for mercurial fixes the following issues :

Security issues fixed :

  - CVE-2018-13346: Fix mpatch_apply function in mpatch.c     that incorrectly proceeds in cases where the fragment     start is past the end of the original data     (bsc#1100354).

  - CVE-2018-13347: Fix mpatch.c that mishandles integer     addition and subtraction (bsc#1100355).

  - CVE-2018-13348: Fix the mpatch_decode function in     mpatch.c that mishandles certain situations where there     should be at least 12 bytes remaining after thecurrent     position in the patch data (bsc#1100353).

This update was imported from the SUSE:SLE-15:Update update project.

This update for mercurial fixes the following issues: Security issues fixed :

  - CVE-2018-13346: Fix mpatch_apply function in mpatch.c     that incorrectly proceeds in cases where the fragment     start is past the end of the original data     (bsc#1100354).

  - CVE-2018-13347: Fix mpatch.c that mishandles integer     addition and subtraction (bsc#1100355).

  - CVE-2018-13348: Fix the mpatch_decode function in     mpatch.c that mishandles certain situations where there     should be at least 12 bytes remaining after thecurrent     position in the patch data (bsc#1100353).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mercurial fixes the following issues :

Security issues fixed :

  - CVE-2018-13348: Fix the mpatch_decode function in     mpatch.c that mishandles certain situations where there     should be at least 12 bytes remaining after thecurrent     position in the patch data (boo#1100353).

  - CVE-2018-13347: Fix mpatch.c that mishandles integer     addition and subtraction (boo#1100355).

  - CVE-2018-13346: Fix the mpatch_apply function in     mpatch.c that incorrectly proceeds in cases where the     fragment start is past the end of the original data     (boo#1100354).

ID	Name	Product	Family	Severity
203099	Photon OS 2.0: Mercurial PHSA-2019-2.0-0159	Nessus	PhotonOS Local Security Checks	critical
199096	RHEL 6 : mercurial (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
180771	Oracle Linux 7 : mercurial (ELSA-2019-2276)	Nessus	Oracle Linux Local Security Checks	critical
139244	Debian DLA-2293-1 : mercurial security update	Nessus	Debian Local Security Checks	critical
137484	EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2020-1642)	Nessus	Huawei Local Security Checks	critical
132497	NewStart CGSL CORE 5.05 / MAIN 5.05 : mercurial Multiple Vulnerabilities (NS-SA-2019-0234)	Nessus	NewStart CGSL Local Security Checks	critical
131410	NewStart CGSL CORE 5.04 / MAIN 5.04 : mercurial Multiple Vulnerabilities (NS-SA-2019-0216)	Nessus	NewStart CGSL Local Security Checks	critical
130735	EulerOS 2.0 SP3 : mercurial (EulerOS-SA-2019-2273)	Nessus	Huawei Local Security Checks	critical
130676	EulerOS 2.0 SP5 : mercurial (EulerOS-SA-2019-2214)	Nessus	Huawei Local Security Checks	critical
128380	CentOS 7 : mercurial (CESA-2019:2276)	Nessus	CentOS Local Security Checks	critical
128241	Scientific Linux Security Update : mercurial on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	critical
127702	RHEL 7 : mercurial (RHSA-2019:2276)	Nessus	Red Hat Local Security Checks	critical
123230	openSUSE Security Update : mercurial (openSUSE-2019-541)	Nessus	SuSE Local Security Checks	critical
120055	SUSE SLED15 / SLES15 Security Update : mercurial (SUSE-SU-2018:1998-1)	Nessus	SuSE Local Security Checks	critical
111424	openSUSE Security Update : mercurial (openSUSE-2018-772)	Nessus	SuSE Local Security Checks	critical
111192	openSUSE Security Update : mercurial (openSUSE-2018-734)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2018-13346

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical