[Python-apps-team] mercurial stable update for CVE-2008-4297
Nico Golde
nion at debian.org
Mon Oct 6 11:36:53 UTC 2008
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for mercurial some time ago.
CVE-2008-4297[0]:
| Mercurial before 1.0.2 does not enforce the allowpull permission
| setting for a pull operation from hgweb, which allows remote attackers
| to read arbitrary files from a repository via an "hg pull" request.
Unfortunately the vulnerability described above is not important enough
to get it fixed via regular security update in Debian stable. It does
not warrant a DSA.
This is Debian bug #500781.
However it would be nice if this could get fixed via a regular point update[1].
Please contact the release team for this.
This is an automatically generated mail, in case you are already working on an
upgrade this is of course pointless.
For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4297
[1] http://www.debian.org/doc/developers-reference/pkgs.html#upload-stable
Kind regards
Nico
--
Nico Golde - http://www.ngolde.de - nion at jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/python-apps-team/attachments/20081006/d4e0126e/attachment.pgp
More information about the Python-apps-team
mailing list