—

PYSEC-2017-88

Quick fix

PYSEC-2017-88 — mercurial: upgrade to the fixed version with the command below.

pip install --upgrade 'mercurial>=4.3'

Details

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository

Are you affected?

Enter the version of the package you're using.

Affected packages

Introduced in: 0Fixed in: 4.3

Fixpip install --upgrade 'mercurial>=4.3'

References

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29[WEB]
https://security.gentoo.org/glsa/201709-18[ADVISORY]
http://www.securityfocus.com/bid/100290[WEB]
http://www.debian.org/security/2017/dsa-3963[ADVISORY]
https://access.redhat.com/errata/RHSA-2017:2489[ADVISORY]
https://github.com/advisories/GHSA-hvr9-wr9p-grgr[ADVISORY]