Executive brief
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
Affected products
- PyPI mercurial
Junglewise Threat Intelligence
CVE-2019-3902: PYSEC-2019-188 - A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and
CVE-2019-3902 · Severity: low · CVSS 3 · Published 2019-04-22
Technologies: mercurial (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-666 - Mercurial Directory traversal vulnerability
- PYSEC-2026-665 - Mercurial Improper Certificate Validation vulnerability
- PYSEC-2020-217 - Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before
- PYSEC-2018-91 - cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
- PYSEC-2018-88 - The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of th