CVE-2017-9462 (High) detected in mercurial-3.5.2.tar.gz

[mend-bolt-for-github]

CVE-2017-9462 - High Severity Vulnerability

Vulnerable Library - mercurial-3.5.2.tar.gz

Fast scalable distributed SCM (revision control, version control) system

Library home page: https://files.pythonhosted.org/packages/77/6a/e00b2e98eae73d5c2d811204f635e1855c8af9eb6fd67a1fa783c5d2b63f/mercurial-3.5.2.tar.gz

Path to dependency file: example-pip-travis/requirements.txt

Path to vulnerable library: example-pip-travis/requirements.txt

Dependency Hierarchy:

• ❌ mercurial-3.5.2.tar.gz (Vulnerable Library)

Found in HEAD commit: 3f5372056bdcd8eea6c1d9f545fe09c32d6d54ea

Vulnerability Details

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Publish Date: 2017-06-06

URL: CVE-2017-9462

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9462

Release Date: 2017-06-06

Fix Resolution: 4.1.3