CVE-2019-3902: Path Traversal
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mercurialto a version that resolves this vulnerability.Fixed in 4.9 - Upgrade
Upgrade
debian/mercurialto a version that resolves this vulnerability.Fixed in 5.6.1-4Fixed in 5.6.1-4+deb11u1Fixed in 6.3.2-1+deb12u1Fixed in 7.0.1-2Fixed in 7.1.1-1Fixed in 7.2-4 - Upgrade
Upgrade
alpine/mercurialto a version that resolves this vulnerability.Fixed in 4.9-r0 - Upgrade
Upgrade
alpine/mercurialto a version that resolves this vulnerability.Fixed in 4.5.2-r1 - Upgrade
Upgrade
alpine/mercurialto a version that resolves this vulnerability.Fixed in 4.6.1-r1 - Upgrade
Upgrade
Mercurialto a version that resolves this vulnerability.Fixed in 4.9
Event History
Frequently Asked Questions
What is CVE-2019-3902?
CVE-2019-3902 is a vulnerability found in Mercurial before version 4.9 that allows the use of symlinks and subrepositories to write files outside a repository.
How does CVE-2019-3902 affect Mercurial?
CVE-2019-3902 affects Mercurial before version 4.9 by defeating Mercurial's path-checking logic and enabling the writing of files outside a repository.
What is the severity of CVE-2019-3902?
The severity of CVE-2019-3902 is medium with a severity value of 5.9.
Which software versions are affected by CVE-2019-3902?
Mercurial before version 4.9, Debian Linux 8.0, and Redhat Enterprise Linux 7.0 are affected by CVE-2019-3902.
How can CVE-2019-3902 be fixed?
To fix CVE-2019-3902, users should update Mercurial to version 4.9 or higher.