—

PYSEC-2019-188

Quick fix

PYSEC-2019-188 — mercurial: upgrade to the fixed version with the command below.

pip install --upgrade 'mercurial>=4.9'

Details

A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mercurial

Introduced in: 0Fixed in: 4.9

Fixpip install --upgrade 'mercurial>=4.9'

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902[REPORT]
https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html[WEB]
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29[WEB]
https://usn.ubuntu.com/4086-1/[WEB]
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html[WEB]
https://github.com/advisories/GHSA-mq66-vcfc-8246[ADVISORY]