oss-security - Re: CVE Request (mercurial)

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 29 Sep 2008 16:56:59 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Cc: Ludwig Nussel <ludwig.nussel@...e.de>,
 coley@...re.org
Subject: Re: CVE Request (mercurial)

On Monday 29 September 2008, Ludwig Nussel wrote:
> Josh Bressers wrote:
> > Looks like there's one more flaw in Mercurial we missed:
> > http://www.selenic.com/mercurial/wiki/index.cgi/WhatsNew#head-905b8
> >adb3420a77d92617e06590055bd8952e02b
> >
> > * hgweb: fix "allowpull" permission being ignored when pulling from
> > hgweb
>
> Did anyone assign a CVE number for this issue yet?
>
> cu
> Ludwig

Yes, only recently:

CVE-2008-4297 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4297):
  Mercurial before 1.0.2 does not enforce the allowpull permission
  setting for a pull operation from hgweb, which allows remote
  attackers to read arbitrary files from a repository via an "hg pull"
  request.

Robert

[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.