CVE-2014-9462

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 78%
VendorProductVersion
opensuseopensuse
13.1
opensuseopensuse
13.2
mercurialmercurial
𝑥
≤ 3.2.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mercurial
bullseye
5.6.1-4
fixed
bookworm
6.3.2-1
fixed
sid
6.8.2-1
fixed
trixie
6.8.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mercurial
vivid
Fixed 3.1.2-2+deb8u1build0.15.04.2
released
utopic
Fixed 3.1.1-1ubuntu0.2
released
trusty
Fixed 2.8.2-1ubuntu1.3
released
precise
Fixed 2.0.2-1ubuntu1.2
released
lucid
ignored
Common Weakness Enumeration
References
http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html
http://mercurial.selenic.com/wiki/WhatsNew
http://www.debian.org/security/2015/dsa-3257
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.osvdb.org/119816
https://security.gentoo.org/glsa/201612-19
http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html
http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html
http://mercurial.selenic.com/wiki/WhatsNew
http://www.debian.org/security/2015/dsa-3257
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.osvdb.org/119816
https://security.gentoo.org/glsa/201612-19