CVE-2017-9462: High severity Mercurial Mercurial vulnerability
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mercurialto a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
pip/mercurialto a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
Mercurialto a version that resolves this vulnerability.Fixed in 4.1.3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9462?
CVE-2017-9462 is considered a medium severity vulnerability because it allows remote authenticated users to execute arbitrary code.
How do I fix CVE-2017-9462?
To fix CVE-2017-9462, upgrade Mercurial to version 4.1.3 or later.
What software is affected by CVE-2017-9462?
CVE-2017-9462 affects Mercurial versions prior to 4.1.3, specifically on platforms like Debian and Red Hat Enterprise Linux.
What type of attack does CVE-2017-9462 enable?
CVE-2017-9462 enables remote authenticated users to launch the Python debugger, potentially leading to arbitrary code execution.
Is CVE-2017-9462 present in the latest versions of Mercurial?
No, CVE-2017-9462 is not present in Mercurial version 4.1.3 and later, as it has been patched.