—

PYSEC-2018-87

Quick fix

PYSEC-2018-87 — mercurial: upgrade to the fixed version with the command below.

pip install --upgrade 'mercurial>=4.5.1'

Details

Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mercurial

Introduced in: 0Fixed in: 4.5.1

Fixpip install --upgrade 'mercurial>=4.5.1'

References

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29[WEB]
https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html[WEB]
https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html[WEB]
https://access.redhat.com/errata/RHSA-2019:2276[ADVISORY]
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html[WEB]
https://github.com/advisories/GHSA-4mr4-7vjv-9hm6[ADVISORY]