—

PYSEC-2017-89

Quick fix

PYSEC-2017-89 — mercurial: upgrade to the fixed version with the command below.

pip install --upgrade 'mercurial>=4.3'

Details

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 0Fixed in: 4.3

Fixpip install --upgrade 'mercurial>=4.3'

References

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29[WEB]
https://security.gentoo.org/glsa/201709-18[ADVISORY]
http://www.securityfocus.com/bid/100290[WEB]
http://www.debian.org/security/2017/dsa-3963[ADVISORY]
https://access.redhat.com/errata/RHSA-2017:2489[ADVISORY]
https://github.com/advisories/GHSA-3qmg-c9vc-r47j[ADVISORY]