mercurial: CVE-2018-1000132

Debian Bug report logs - #892964
mercurial: CVE-2018-1000132

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: mercurial: CVE-2018-1000132

Date: Wed, 14 Mar 2018 22:28:35 +0100

Source: mercurial
Version: 3.1.2-1
Severity: grave
Tags: security upstream

Hi,

the following vulnerability was published for mercurial.

CVE-2018-1000132[0]:
| Mercurial version 4.5 and earlier contains a Incorrect Access Control
| (CWE-285) vulnerability in Protocol server that can result in
| Unauthorized data access. This attack appear to be exploitable via
| network connectivity. This vulnerability appears to have been fixed in
| 4.5.1.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-1000132
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000132
[1] https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29

Regards,
Salvatore

Message #10 received at 892964-done@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: 892964-done@bugs.debian.org, 892743-done@bugs.debian.org

Subject: Security bugs fixed in mercurial 4.5.2-1

Date: Wed, 21 Mar 2018 14:48:54 +0100

Source: mercurial
Version: 4.5.2-1

Apologies for not including this in the package changelog.  The 4.5.2
release (just uploaded) includes fixes for these security bugs.

Cheers,
Julien

Send a report that this bug log contains spam.