GitHub Advisoryadvisory · PyPI

GHSA-v2gw-x5jf-pgwv Mercurial Directory traversal vulnerability

MEDIUM Published 2022-05-01 Modified 2023-09-22 Official page ↗
Aliases
CVE-2008-2942
Ecosystem
PyPI
Packages
mercurial
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2023-09-22

Affected packages

• PyPI mercurial: < 1.0.2 → fixed in 1.0.2

Description

Directory traversal vulnerability in patch.py in Mercurial before 1.0.2 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.

Related

Alias · CVE (1)

  • CVE-2008-2942 Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References