(RHSA-2017:1576) Important: mercurial security update

2017-06-2705:25:17

access.redhat.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.03 Low

EPSS

Percentile

90.8%

JSON

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es):

A flaw was found in the way “hg serve --stdio” command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)

OSVersionArchitecturePackageVersionFilename
RedHat7x86_64emacs-mercurial-el< 2.6.2-7.el7_3emacs-mercurial-el-2.6.2-7.el7_3.x86_64.rpm
RedHat6i686mercurial-debuginfo< 1.4-5.el6_9mercurial-debuginfo-1.4-5.el6_9.i686.rpm
RedHat7aarch64emacs-mercurial-el< 2.6.2-7.el7_3emacs-mercurial-el-2.6.2-7.el7_3.aarch64.rpm
RedHat6i686emacs-mercurial< 1.4-5.el6_9emacs-mercurial-1.4-5.el6_9.i686.rpm
RedHat7ppc64mercurial-debuginfo< 2.6.2-7.el7_3mercurial-debuginfo-2.6.2-7.el7_3.ppc64.rpm
RedHat6x86_64mercurial< 1.4-5.el6_9mercurial-1.4-5.el6_9.x86_64.rpm
RedHat7ppc64mercurial-hgk< 2.6.2-7.el7_3mercurial-hgk-2.6.2-7.el7_3.ppc64.rpm
RedHat7x86_64mercurial< 2.6.2-7.el7_3mercurial-2.6.2-7.el7_3.x86_64.rpm
RedHat6x86_64mercurial-debuginfo< 1.4-5.el6_9mercurial-debuginfo-1.4-5.el6_9.x86_64.rpm
RedHat6x86_64emacs-mercurial< 1.4-5.el6_9emacs-mercurial-1.4-5.el6_9.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	7	x86_64	emacs-mercurial-el	< 2.6.2-7.el7_3	emacs-mercurial-el-2.6.2-7.el7_3.x86_64.rpm
RedHat	6	i686	mercurial-debuginfo	< 1.4-5.el6_9	mercurial-debuginfo-1.4-5.el6_9.i686.rpm
RedHat	7	aarch64	emacs-mercurial-el	< 2.6.2-7.el7_3	emacs-mercurial-el-2.6.2-7.el7_3.aarch64.rpm
RedHat	6	i686	emacs-mercurial	< 1.4-5.el6_9	emacs-mercurial-1.4-5.el6_9.i686.rpm
RedHat	7	ppc64	mercurial-debuginfo	< 2.6.2-7.el7_3	mercurial-debuginfo-2.6.2-7.el7_3.ppc64.rpm
RedHat	6	x86_64	mercurial	< 1.4-5.el6_9	mercurial-1.4-5.el6_9.x86_64.rpm
RedHat	7	ppc64	mercurial-hgk	< 2.6.2-7.el7_3	mercurial-hgk-2.6.2-7.el7_3.ppc64.rpm
RedHat	7	x86_64	mercurial	< 2.6.2-7.el7_3	mercurial-2.6.2-7.el7_3.x86_64.rpm
RedHat	6	x86_64	mercurial-debuginfo	< 1.4-5.el6_9	mercurial-debuginfo-1.4-5.el6_9.x86_64.rpm
RedHat	6	x86_64	emacs-mercurial	< 1.4-5.el6_9	emacs-mercurial-1.4-5.el6_9.x86_64.rpm