CVE-2014-9462 Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command

What is CVE-2014-9462?

CVE-2014-9462 is a high-severity command injection vulnerability in Opensuse Opensuse, published on 31 Mar 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The _validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

Weakness: CWE-20

Which versions are affected by CVE-2014-9462?

3 open source packages ship an affected version, including mercurial. It affects 2 products.

Products include Mercurial Mercurial, Opensuse Opensuse.

How do I fix CVE-2014-9462?

Upgrade mercurial to 3.2.4 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2014-9462 being exploited?

There is no known exploitation of CVE-2014-9462 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Opensuse

• CVE-2018-13347 Mercurial mishandles integer addition and subtraction Critical 9.8
• CVE-2018-17983 Mercurial Out-of-bounds Read vulnerability Critical 9.1
• CVE-2018-13346 Mercurial Improper Input Validation vulnerability High 7.5
• CVE-2018-13348 Mercurial Improper Input Validation vulnerability High 7.5
• CVE-2008-2942 Mercurial Directory traversal vulnerability Medium 6.8

All Opensuse Opensuse vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-9462, DSA-3257-1, GHSA-3pmw-h7j4-rf54, MGASA-2015-0129, PYSEC-2015-14, SUSE-SU-2015:0817-1 and 2 more.