Bug 1459482 - (CVE-2017-9462) CVE-2017-9462 mercurial: Python debugger accessible to authorized users
CVE-2017-9462 mercurial: Python debugger accessible to authorized users
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 1460965 1459485 1460964 1460966 1460967
Blocks: 1459488
  Show dependency treegraph
Reported: 2017-06-07 05:23 EDT by Adam Mariš
Modified: 2017-08-24 04:48 EDT (History)
4 users (show)

See Also:
Fixed In Version: mercurial 4.1.3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way "hg serve --stdio" command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options.
Story Points: ---
Clone Of:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2017-06-07 05:23:41 EDT
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.



Upstream patch:

Comment 1 Adam Mariš 2017-06-07 05:24:10 EDT
Created mercurial tracking bugs for this issue:

Affects: fedora-all [bug 1459485]
Comment 9 errata-xmlrpc 2017-06-27 03:31:04 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2017:1576 https://access.redhat.com/errata/RHSA-2017:1576

Note You need to log in before you can comment on or make changes to this bug.