—

PYSEC-2015-14

Quick fix

PYSEC-2015-14 — mercurial: upgrade to the fixed version with the command below.

pip install --upgrade 'mercurial>=3.2.4'

Details

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mercurial

Introduced in: 0Fixed in: 3.2.4

Fixpip install --upgrade 'mercurial>=3.2.4'

References

http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html[WEB]
http://mercurial.selenic.com/wiki/WhatsNew[WEB]
http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html[WEB]
http://www.osvdb.org/119816[WEB]
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html[WEB]
http://www.debian.org/security/2015/dsa-3257[ADVISORY]
https://security.gentoo.org/glsa/201612-19[ADVISORY]
https://github.com/advisories/GHSA-3pmw-h7j4-rf54[ADVISORY]