openSUSE Security Update : mercurial (mercurial-230)

The hgweb script didn't enforce the 'allowpull' permission setting which allowed anyone to retrieve files from the repository CVE-2008-4297 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

DEBIAN-CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request...

CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request...

CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission for hgweb pulls, allowing remote attackers to read arbitrary files from a repository via an hg pull request. Affected product: Mercurial (hgweb) prior to 1.0.2. Root cause: missing enforcement of allowpull in hgweb. Impact: potentia...