Skip to content
OpenAdvisories
High RHSA-2017:1576 1 CVE

Red Hat Security Advisory: mercurial security update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client emacs-mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client emacs-mercurial-el 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client mercurial-debuginfo 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client mercurial-hgk 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode emacs-mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode emacs-mercurial-el 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode mercurial-debuginfo 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode mercurial-hgk 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server emacs-mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server emacs-mercurial-el 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server mercurial-debuginfo 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server mercurial-hgk 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation emacs-mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation emacs-mercurial-el 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation mercurial 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation mercurial-debuginfo 0:1.4-5.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation mercurial-hgk 0:1.4-5.el6_9
Red Hat · RHEL 7 enterprise_linux:7::client emacs-mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client emacs-mercurial-el 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client mercurial-debuginfo 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client mercurial-hgk 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode emacs-mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode emacs-mercurial-el 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial-debuginfo 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial-hgk 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server emacs-mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server emacs-mercurial-el 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server mercurial-debuginfo 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server mercurial-hgk 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation emacs-mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation emacs-mercurial-el 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial-debuginfo 0:2.6.2-7.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial-hgk 0:2.6.2-7.el7_3

Vulnerabilities 1

  • High 8.8
    CVE-2017-9462 Public exploit EPSS 22%

    Mercurial has Incorrect Permission Assignment for Critical Resource

    In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

    mercurial mercurial mercurial Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1459482
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1576.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-9462
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-9462
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-9462