Re: CVE Request (mercurial)

[Robert Buchholz <rbu () gentoo org>]

On Monday 29 September 2008, Ludwig Nussel wrote:
> Josh Bressers wrote:
> > Looks like there's one more flaw in Mercurial we missed:
> > http://www.selenic.com/mercurial/wiki/index.cgi/WhatsNew#head-905b8
> > adb3420a77d92617e06590055bd8952e02b
> >
> > * hgweb: fix "allowpull" permission being ignored when pulling from
> > hgweb
>
> Did anyone assign a CVE number for this issue yet?
>
> cu
> Ludwig

Yes, only recently:

CVE-2008-4297 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4297):
  Mercurial before 1.0.2 does not enforce the allowpull permission
  setting for a pull operation from hgweb, which allows remote
  attackers to read arbitrary files from a repository via an "hg pull"
  request.


Robert

Attachment: signature.asc
Description: This is a digitally signed message part.