p PatchFirst

CVE-2008-4297

CVE-2008-4297

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request.

EPSS 2.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mercurial Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.0.1-5.1

    Update to 1.0.1-5.1

  • mercurial Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.0.1-5.1

    Update to 1.0.1-5.1

  • mercurial Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.0.1-5.1

    Update to 1.0.1-5.1

Original sources

Check your server →