Information disclosure in Mercurial - CVE-2018-1000132

Vulnerability identifier: #VU11150

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1000132

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper access control. A remote attacker can gain access to potentially sensitive information.

Mercurial
mercurial (Alpine package)
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing

Update to version 4.5.1.

mercurial (Alpine package) - update to 4.5.2-r0

• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29

• Information disclosure in Mercurial
• Red Hat update for mercurial
• Information disclosure in mercurial (Alpine package)