CVE-2018-1000132
Fixed in a distro release EPSS 3%
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
Products: mercurial, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mercurial | 4.5.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.5 | mercurial | 4.5.2-r0 |
| Alpine 3.6 | mercurial | 4.5.2-r0 |
| Alpine 3.7 | mercurial | 4.5.2-r0 |
| Debian 12 | mercurial | 4.5.2-1 |
| Debian 13 | mercurial | 4.5.2-1 |
| Debian 14 | mercurial | 4.5.2-1 |
| Debian 7 | mercurial | 2.2.2-4+deb7u7 |
| Debian 8 | mercurial | 3.1.2-2+deb8u5 |
| Debian 9 | mercurial | 4.0-1+deb9u2 |
| Red Hat Enterprise Linux 7 | emacs-mercurial | 0:2.6.2-10.el7 |
| Red Hat Enterprise Linux 7 | emacs-mercurial-el | 0:2.6.2-10.el7 |
| Red Hat Enterprise Linux 7 | mercurial | 0:2.6.2-10.el7 |
| Red Hat Enterprise Linux 7 | mercurial-debuginfo | 0:2.6.2-10.el7 |
| Red Hat Enterprise Linux 7 | mercurial-hgk | 0:2.6.2-10.el7 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | mercurial | 2.8.2-15.10.1 |
| Ubuntu 14.04 LTS | mercurial | 2.8.2-1ubuntu1.4 |
| Ubuntu 16.04 LTS | mercurial | 3.7.3-1ubuntu1.1 |
| openSUSE Tumbleweed | mercurial | 5.9.1-2.1 |