PT-2018-1893 · Mercurial+4 · Mercurial+4

Publicado 2018-03-14 · Atualizado 2024-06-15 · CVE-2018-1000132

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.5.1

Description The issue is related to incorrect access control in the protocol server, which can lead to unauthorized data access. This can be exploited via network connectivity, potentially allowing a remote attacker to compromise data confidentiality and integrity.

Recommendations For Mercurial versions prior to 4.5.1, update to version 4.5.1 or later to resolve the issue. As a temporary workaround, consider restricting network connectivity to the protocol server until the update can be applied.

Correção

Incorrect Permission

Improper Access Control

Enumeração de Fraquezas

CWE-732

CWE-284

Identificadores relacionados

ALT-PU-2018-2508

BDU:2018-01497

CESA-2019_2276

CVE-2018-1000132

DLA-1331-1

DLA-1414-1

DLA-2293-1

GHSA-4MR4-7VJV-9HM6

MGASA-2018-0355

OPENSUSE-SU-2024:10586-1

PYSEC-2018-87

RHSA-2019:2276

RHSA-2019_2276

SUSE-SU-2018:0933-1

SUSE-SU-2018_0933-1

Produtos afetados

Alt Linux

Centos

Mercurial

Red Hat

Suse

Referências · 40

• https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-87.yaml · Nota
• https://ubuntu.com/security/CVE-2018-1000132 · Aviso do Fabricante
• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000132 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-1000115 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-1000132 · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2018-1000132 · Nota
• https://suse.com/security/cve/CVE-2008-2942 · Nota
• https://advisories.mageia.org/MGASA-2018-0355.html · Nota de Segurança
• https://lists.opensuse.org/opensuse-updates/2018-07/msg00057.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000132 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-2293-1 · Aviso do Fabricante
• https://mercurial-scm.org/repo/hg/rev/2ecb0fc535b1 · Nota
• https://cve.org/CVERecord?id=CVE-2018-1000132 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:10586-1 · Aviso do Fabricante