Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command

높음 7.5CVE-2014-9462 · GHSA-3pmw-h7j4-rf54 · PYSEC-2015-14 · Published 31/03/2015 · updated 17/06/2026

요약

CVE-2014-9462은(는) mercurial, mercurial (mercurial)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 4.2%, 전체 취약점의 90.9%보다 높음.
조치: 3.2.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mercurial PyPI	`< 3.2.4`	`3.2.4`
mercurial mercurial	`≤ 3.2.3`	No fix yet

Description

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

NVD description

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

References

nvd.nist.gov/vuln/detail/CVE-2014-9462 · ADVISORY
pypa/advisory-database · WEB
security.gentoo.org/glsa/201612-19 · WEB
chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html · WEB
lists.opensuse.org/opensuse-updates/2015-03/msg00085.html · WEB
mercurial.selenic.com/wiki/WhatsNew · WEB
debian.org/security/2015/dsa-3257 · WEB
oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html · WEB
osvdb.org/119816
GitHub Advisory GHSA-3pmw-h7j4-rf54 · ADVISORY

mercurial의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mercurial

PyPI

< 3.2.4

3.2.4

mercurial

≤ 3.2.3

No fix yet

Description

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

NVD description

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

mercurial의 다른 취약점

모두 보기 →