id: PYSEC-2017-91
details: In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated
  users to launch the Python debugger, and consequently execute arbitrary code, by
  using --debugger as a repository name.
affected:
- package:
    name: mercurial
    ecosystem: PyPI
    purl: pkg:pypi/mercurial
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 4.1.3
  versions:
  - 0.8.1
  - '0.9'
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 0.9.4
  - 0.9.5
  - '1.0'
  - 1.0.1
  - 1.0.2
  - '1.1'
  - 1.1.1
  - 1.1.2
  - '1.2'
  - 1.2.1
  - '1.3'
  - 1.3.1
  - '1.4'
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - '1.5'
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - '1.6'
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - '1.7'
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.5
  - '1.8'
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - '1.9'
  - 1.9.1
  - 1.9.2
  - 1.9.3
  - '2.0'
  - 2.0.1
  - 2.0.2
  - '2.1'
  - 2.1.1
  - 2.1.2
  - '2.2'
  - 2.2.2
  - '2.3'
  - 2.4.1
  - '2.5'
  - 2.5.1
  - 2.5.2
  - '2.6'
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - '2.8'
  - 2.8.1
  - 2.8.2
  - '2.9'
  - 2.9.1
  - '3.0'
  - 3.0.1
  - '3.1'
  - 3.1.1
  - 3.1.2
  - '3.2'
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2.4
  - '3.3'
  - 3.3-rc
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - '3.4'
  - 3.4-rc
  - 3.4.1
  - 3.4.2
  - '3.5'
  - 3.5-rc
  - 3.5.1
  - 3.5.2
  - '3.6'
  - 3.6-rc
  - 3.6.1
  - 3.6.2
  - 3.6.3
  - '3.7'
  - 3.7-rc
  - 3.7.1
  - 3.7.2
  - 3.7.3
  - '3.8'
  - 3.8-rc
  - 3.8.1
  - 3.8.2
  - 3.8.3
  - 3.8.4
  - '3.9'
  - 3.9-rc
  - 3.9.1
  - 3.9.2
  - '4.0'
  - 4.0-rc
  - 4.0.1
  - 4.0.2
  - '4.1'
  - 4.1-rc
  - 4.1.1
  - 4.1.2
references:
- type: WEB
  url: https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29
- type: WEB
  url: https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499
- type: WEB
  url: https://bugs.debian.org/861243
- type: WEB
  url: http://www.securityfocus.com/bid/99123
- type: ADVISORY
  url: https://security.gentoo.org/glsa/201709-18
- type: ADVISORY
  url: http://www.debian.org/security/2017/dsa-3963
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2017:1576
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-ghjx-3jg5-h6r2
aliases:
- CVE-2017-9462
- GHSA-ghjx-3jg5-h6r2
modified: '2021-08-27T03:22:07.149994Z'
published: '2017-06-06T21:29:00Z'