CVE-2008-2942 Mercurial Directory traversal vulnerability
Attackers can modify arbitrary files via directory traversal in Mercurial patch files, requiring user assistance to apply the malicious patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Not stated
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-2942?
CVE-2008-2942 is a medium-severity path traversal vulnerability in n/a, published on 30 Jun 2008.
Official description
Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.
Weakness: CWE-22
Which versions are affected by CVE-2008-2942?
3 open source packages ship an affected version, including mercurial. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mercurial PyPI | All versions | 1.0.2 |
mercurial PyPI | All versions | 1.0.2 |
mercurial PyPI | All versions | 1.0.2 |
Products include Mercurial Mercurial.
How do I fix CVE-2008-2942?
Upgrade mercurial to 1.0.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2008-2942 being exploited?
There is no known exploitation of CVE-2008-2942 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-13347 Mercurial mishandles integer addition and subtraction
- CVE-2018-17983 Mercurial Out-of-bounds Read vulnerability
- CVE-2018-13346 Mercurial Improper Input Validation vulnerability
- CVE-2018-13348 Mercurial Improper Input Validation vulnerability
- CVE-2014-9462 Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command
Sources
Also known as DEBIAN-CVE-2008-2942, GHSA-v2gw-x5jf-pgwv, PYSEC-2026-666.