This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2017-9462 →

DEBIAN-CVE-2017-9462

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code...

Original description

The description as published by the source.

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 mercurial

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]

Debian:13 mercurial

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]

Debian:14 mercurial

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.1-1"}]}]

References

advisory security-tracker.debian.org