CVE-2018-13348 Mercurial Improper Input Validation vulnerability
A flaw in Mercurial's patch decoding allows attackers to cause a denial of service via malformed patch data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-13348?
CVE-2018-13348 is a high-severity vulnerability in n/a, published on 6 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
Weakness: CWE-20
Which versions are affected by CVE-2018-13348?
3 open source packages ship an affected version, including mercurial. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mercurial PyPI | All versions | 4.6.1 |
mercurial PyPI | All versions | 4.6.1 |
mercurial PyPI | All versions | 4.6.1 |
Products include Mercurial Mercurial.
How do I fix CVE-2018-13348?
Upgrade mercurial to 4.6.1 or later.
Is CVE-2018-13348 being exploited?
There is no known exploitation of CVE-2018-13348 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-13347 Mercurial mishandles integer addition and subtraction
- CVE-2018-17983 Mercurial Out-of-bounds Read vulnerability
- CVE-2018-13346 Mercurial Improper Input Validation vulnerability
- CVE-2014-9462 Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command
- CVE-2008-2942 Mercurial Directory traversal vulnerability
Sources
Also known as DEBIAN-CVE-2018-13348, GHSA-3v62-ww8w-758m, PYSEC-2018-90, UBUNTU-CVE-2018-13348.