Mercurial has Incorrect Permission Assignment for Critical Resource

HIGH 8.8CVE-2017-9462 · GHSA-ghjx-3jg5-h6r2 · PYSEC-2017-91 · Published 06/06/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
mercurial PyPI	`< 4.1.3`	`4.1.3`
mercurial mercurial	`< 4.1.3`	`4.1.3`

Description

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

NVD description

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

References

nvd.nist.gov/vuln/detail/CVE-2017-9462 · ADVISORY
access.redhat.com/errata/RHSA-2017:1576 · WEB
bugs.debian.org/861243 · WEB
GitHub Advisory GHSA-ghjx-3jg5-h6r2 · ADVISORY
pypa/advisory-database · WEB
lists.debian.org/debian-lts-announce/2018/07/msg00005.html · WEB
security.gentoo.org/glsa/201709-18 · WEB
web.archive.org/web/20200227162318/http://www.securityfocus.com/bid/99123 · WEB
mercurial-scm.org/repo/hg/rev/77eaf9539499 · WEB
mercurial-scm.org/wiki/WhatsNew · WEB
debian.org/security/2017/dsa-3963 · WEB
securityfocus.com/bid/99123 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free