Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2276 advisory.

  - The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the     fragment start is past the end of the original data, aka OVE-20180430-0004. (CVE-2018-13346)

  - mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
    (CVE-2018-13347)

  - Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol     server that can result in Unauthorized data access. This attack appear to be exploitable via network     connectivity. This vulnerability appears to have been fixed in 4.5.1. (CVE-2018-1000132)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in mercurial, an easy-to-use, scalable distributed version control system.

CVE-2017-17458

In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository.
Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.

CVE-2018-13346

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data.

CVE-2018-13347

mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction.

CVE-2018-13348

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not.

CVE-2018-1000132

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

CVE-2019-3902

Symbolic links and subrepositories could be used defeat Mercurial's path-checking logic and write files outside the repository root.

For Debian 9 stretch, these problems have been fixed in version 4.0-1+deb9u2.

We recommend that you upgrade your mercurial packages.

For the detailed security status of mercurial please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mercurial

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mercurial packages installed that are affected by multiple vulnerabilities:

  - Mercurial version 4.5 and earlier contains a Incorrect     Access Control (CWE-285) vulnerability in Protocol     server that can result in Unauthorized data access. This     attack appear to be exploitable via network     connectivity. This vulnerability appears to have been     fixed in 4.5.1. (CVE-2018-1000132)

  - The mpatch_apply function in mpatch.c in Mercurial     before 4.6.1 incorrectly proceeds in cases where the     fragment start is past the end of the original data, aka     OVE-20180430-0004. (CVE-2018-13346)

  - mpatch.c in Mercurial before 4.6.1 mishandles integer     addition and subtraction, aka OVE-20180430-0002.
    (CVE-2018-13347)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mercurial packages installed that are affected by multiple vulnerabilities:

  - Mercurial version 4.5 and earlier contains a Incorrect     Access Control (CWE-285) vulnerability in Protocol     server that can result in Unauthorized data access. This     attack appear to be exploitable via network     connectivity. This vulnerability appears to have been     fixed in 4.5.1. (CVE-2018-1000132)

  - The mpatch_apply function in mpatch.c in Mercurial     before 4.6.1 incorrectly proceeds in cases where the     fragment start is past the end of the original data, aka     OVE-20180430-0004. (CVE-2018-13346)

  - mpatch.c in Mercurial before 4.6.1 mishandles integer     addition and subtraction, aka OVE-20180430-0002.
    (CVE-2018-13347)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for mercurial is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* mercurial: Buffer underflow in mpatch.c:mpatch_apply() (CVE-2018-13347)

* mercurial: HTTP server permissions bypass (CVE-2018-1000132)

* mercurial: Missing check for fragment start position in mpatch.c:mpatch_apply() (CVE-2018-13346)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - mercurial: Buffer underflow in mpatch.c:mpatch_apply()     (CVE-2018-13347)

  - mercurial: HTTP server permissions bypass     (CVE-2018-1000132)

  - mercurial: Missing check for fragment start position in     mpatch.c:mpatch_apply() (CVE-2018-13346)

An update of the mercurial package has been released.

According to the versions of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Mercurial is a fast, lightweight source control     management system designed for efficient handling of     very large distributed projects.

  - Security fix(es):

  - Mercurial version 4.5 and earlier contains a Incorrect     Access Control (CWE-285) vulnerability in Protocol     server that can result in Unauthorized data access.
    This attack appear to be exploitable via network     connectivity. (CVE-2018-1000132)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mercurial fixes the following issue :

  - CVE-2018-1000132: Remote attackers may bypass HTTP     server permissions via batch wire protocol commands     (bsc#1085211)

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

This update also fixes a regression inroduced in 2.2.2-4+deb7u5 which makes the testsuite fail non-deterministically.

For Debian 7 'Wheezy', these problems have been fixed in version 2.2.2-4+deb7u7.

We recommend that you upgrade your mercurial packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180771	Oracle Linux 7 : mercurial (ELSA-2019-2276)	Nessus	Oracle Linux Local Security Checks	critical
139244	Debian DLA-2293-1 : mercurial security update	Nessus	Debian Local Security Checks	critical
132497	NewStart CGSL CORE 5.05 / MAIN 5.05 : mercurial Multiple Vulnerabilities (NS-SA-2019-0234)	Nessus	NewStart CGSL Local Security Checks	critical
131410	NewStart CGSL CORE 5.04 / MAIN 5.04 : mercurial Multiple Vulnerabilities (NS-SA-2019-0216)	Nessus	NewStart CGSL Local Security Checks	critical
128380	CentOS 7 : mercurial (CESA-2019:2276)	Nessus	CentOS Local Security Checks	critical
128241	Scientific Linux Security Update : mercurial on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	critical
127702	RHEL 7 : mercurial (RHSA-2019:2276)	Nessus	Red Hat Local Security Checks	critical
121823	Photon OS 1.0: Mercurial PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	critical
110842	EulerOS 2.0 SP3 : mercurial (EulerOS-SA-2018-1178)	Nessus	Huawei Local Security Checks	critical
110146	EulerOS 2.0 SP1 : mercurial (EulerOS-SA-2018-1142)	Nessus	Huawei Local Security Checks	critical
109510	EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2018-1112)	Nessus	Huawei Local Security Checks	critical
108980	openSUSE Security Update : mercurial (openSUSE-2018-349)	Nessus	SuSE Local Security Checks	critical
108765	Debian DLA-1331-1 : mercurial security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-1000132

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical