Fluid Attacks Database

Description

Mercurial Directory traversal vulnerability Directory traversal vulnerability in patch.py in Mercurial before 1.0.2 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	mercurial	>=0 <1.0.2	1.0.2
debian 12	mercurial	>=0 <1.0.1-2	1.0.1-2
debian 13	mercurial	>=0 <1.0.1-2	1.0.1-2
debian 14	mercurial	>=0 <1.0.1-2	1.0.1-2
debian 11	mercurial	>=0 <1.0.1-2	1.0.1-2

Aliases

1. CVE-2008-29422. NVD-2008-29423. OSV-2008-29424. OSV-DEBIAN-2008-29425. GCVE-2008-29426. security.gentoo.org7. SECURITY-TRACKER-CVE-2008-2942

References

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/435512. https://issues.rpath.com/browse/RPL-26333. http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html4. http://wiki.rpath.com/Advisories:rPSA-2008-02115. http://www.openwall.com/lists/oss-security/2008/06/30/16. http://www.openwall.com/lists/oss-security/2008/07/01/17. http://www.securityfocus.com/archive/1/493881/100/0/threaded8. http://www.securityfocus.com/bid/300729. http://www.selenic.com/hg/rev/87c704ac92d4

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.