GitHub Advisoryadvisory · PyPI

GHSA-mq66-vcfc-8246 Mercurial Path Traversal/Link Following vulnerability

MEDIUM Published 2022-02-15 Modified 2024-09-25 Official page ↗
Aliases
CVE-2019-3902
Ecosystem
PyPI
Packages
mercurial
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22, CWE-59
Reviewed
2024-05-01

Affected packages

• PyPI mercurial: < 4.9 → fixed in 4.9

Description

A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

Related

Alias · CVE (1)

  • CVE-2019-3902 A flaw was found in Mercurial before 4.9. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References