Symlink attack in Mercurial - CVE-2019-3902

Vulnerability identifier: #VU29241

CSH Severity: Medium

CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3902

CWE-ID: CWE-61

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue. A remote user can create a specially crafted symbolic link to and write files outside a repository.

Mercurial
cflinuxfs3
Dell PowerProtect Cyber Recovery
mercurial (Alpine package)
mercurial (Ubuntu package)
mercurial-common (Ubuntu package)
Opensuse
Ubuntu

Install updates from vendor's website.

Mercurial - update to 4.9
cflinuxfs3 - update to 0.261.0
mercurial (Alpine package) - update to 4.5.2-r1
mercurial (Ubuntu package) - update to 4.5.3-1ubuntu2.2
mercurial-common (Ubuntu package) - update to 4.5.3-1ubuntu2.2
Dell PowerProtect Cyber Recovery - update to 18.1.1.2-8

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902
• https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html
• https://usn.ubuntu.com/4086-1/
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29

• Symlink attack in Mercurial
• OpenSUSE Linux update for mercurial
• OpenSUSE Linux update for mercurial
• Symlink attack in mercurial (Alpine package)
• Multiple vulnerabilities in cflinuxfs3
• Ubuntu update for mercurial
• Multiple vulnerabilities in Dell EMC Cyber Recovery