CVE-2014-9462
Fixed in a distro release EPSS 4%
The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mercurial | 3.2.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mercurial | 3.4-1 |
| Debian 13 | mercurial | 3.4-1 |
| Debian 14 | mercurial | 3.4-1 |
| Debian 6.0 | mercurial | 1.6.4-1+deb6u1 |
| Debian 7 | mercurial | 2.2.2-4+deb7u1 |
| Debian 8 | mercurial | 3.1.2-2+deb8u1 |
| SUSE Linux Enterprise Software Development Kit 12 | mercurial | 2.8.2-3.1 |
| Ubuntu 14.04 LTS | mercurial | 2.8.2-1ubuntu1.3 |