A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mercurial: arbitrary command execution in mercurial repo with a git submodule (CVE-2017-17458)

  - The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute     arbitrary commands via a crafted repository name in a clone command. (CVE-2014-9462)

  - The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary     code via a crafted git repository name. (CVE-2016-3105)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - mercurial: Path-checking logic bypass via symlinks and subrepositories (CVE-2019-3902)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5102-2 advisory.

    USN-5102-1 fixed vulnerabilities in Mercurial. This update provides the corresponding updates for Ubuntu     14.04 ESM and Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5102-1 advisory.

    It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this issue     to write arbitrary files to the targets filesystem. (CVE-2019-3902)

    It was discovered that Mercurial incorrectly handled certain manifest files. An attacker could use this     issue to cause a denial of service and possibly execute arbitrary code. (CVE-2018-17983)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in mercurial, an easy-to-use, scalable distributed version control system.

CVE-2017-17458

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository.
Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE-2018-13346

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data.

CVE-2018-13347

mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction.

CVE-2018-13348

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not.

CVE-2018-1000132

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

CVE-2019-3902

Symbolic links and subrepositories could be used defeat Mercurial's path-checking logic and write files outside the repository root.

For Debian 9 stretch, these problems have been fixed in version 4.0-1+deb9u2.

We recommend that you upgrade your mercurial packages.

For the detailed security status of mercurial please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mercurial

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mercurial fixes the following issues :

Security issue fixed :

  - CVE-2019-3902: Fixed incorrect patch-checking with     symlinks and subrepos (bsc#1133035).

This update was imported from the SUSE:SLE-15:Update update project.

This update for mercurial fixes the following issues :

Security issue fixed :

CVE-2019-3902: Fixed incorrect patch-checking with symlinks and subrepos (bsc#1133035).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Mercurial mishandled symlinks in subrepositories. An attacker could use this vulnerability to write arbitrary files to the target's filesystem.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the mercurial package has been released.

It was discovered that there was a path traversal vulnerability in the 'mercurial' distributed revision version control system.

Symbolic links and subrepositories could be used defeat Mercurial's path-checking logic and write files outside the repository root.

For Debian 8 'Jessie', this issue has been fixed in mercurial version 3.1.2-2+deb8u7.

We recommend that you upgrade your mercurial packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199068	RHEL 7 : mercurial (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199055	RHEL 8 : mercurial (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
195804	RHEL 8 : mercurial (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
195752	RHEL 7 : mercurial (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
183575	Ubuntu 16.04 ESM : Mercurial vulnerabilities (USN-5102-2)	Nessus	Ubuntu Local Security Checks	critical
153857	Ubuntu 18.04 LTS : Mercurial vulnerabilities (USN-5102-1)	Nessus	Ubuntu Local Security Checks	critical
139244	Debian DLA-2293-1 : mercurial security update	Nessus	Debian Local Security Checks	critical
138707	openSUSE Security Update : mercurial (openSUSE-2020-880)	Nessus	SuSE Local Security Checks	medium
138703	openSUSE Security Update : mercurial (openSUSE-2020-869)	Nessus	SuSE Local Security Checks	medium
138544	SUSE SLED15 / SLES15 Security Update : mercurial (SUSE-SU-2020:1709-2)	Nessus	SuSE Local Security Checks	medium
138285	SUSE SLED15 / SLES15 Security Update : mercurial (SUSE-SU-2020:1709-1)	Nessus	SuSE Local Security Checks	medium
127803	Ubuntu 19.04 : Mercurial vulnerability (USN-4086-1)	Nessus	Ubuntu Local Security Checks	medium
126116	Photon OS 3.0: Mercurial PHSA-2019-3.0-0015	Nessus	PhotonOS Local Security Checks	medium
125402	Photon OS 1.0: Mercurial PHSA-2019-1.0-0235	Nessus	PhotonOS Local Security Checks	medium
125397	Photon OS 2.0: Mercurial PHSA-2019-2.0-0160	Nessus	PhotonOS Local Security Checks	medium
124306	Debian DLA-1764-1 : mercurial security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-3902

medium

Tenable Plugins

critical

medium

medium

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium