Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify
    arbitrary files via ".." (dot dot) sequences in a patch file. (CVE-2008-2942)

This update of mercurial improves the input validation. Prior to this patch it was possible to touch files as root. (CVE-2008-2942)

The remote host is affected by the vulnerability described in GLSA-200807-09 (Mercurial: Directory traversal)

    Jakub Wilk discovered a directory traversal vulnerability in the     applydiff() function in the mercurial/patch.py file.
  Impact :

    A remote attacker could entice a user to import a specially crafted     patch, possibly resulting in the renaming of arbitrary files, even     outside the repository.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
432344	SCA: security update for mercurial (GHSA-v2gw-x5jf-pgwv)	Tenable Cloud Security	SCA Checks	Local	high
432344	SCA: security update for mercurial (GHSA-v2gw-x5jf-pgwv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
40065	openSUSE Security Update : mercurial (mercurial-75)	Nessus	SuSE Local Security Checks	Local	medium
33509	GLSA-200807-09 : Mercurial: Directory traversal	Nessus	Gentoo Local Security Checks	Local	medium

Detections

Analytics

CVE-2008-2942

high

Tenable Plugins

high

high

medium

medium