ID de Prueba:	1.3.6.1.4.1.25623.1.0.871888
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for mercurial RHSA-2017:2489-01
Resumen:	The remote host is missing an update for the 'mercurial'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'mercurial' package(s) announced via the referenced advisory. Vulnerability Insight: Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects. Security Fix(es): * A vulnerability was found in the way Mercurial handles path auditing and caches the results. An attacker could abuse a repository with a series of commits mixing symlinks and regular files/directories to trick Mercurial into writing outside of a given repository. (CVE-2017-1000115) * A shell command injection flaw related to the handling of 'ssh' URLs has been discovered in Mercurial. This can be exploited to execute shell commands with the privileges of the user running the Mercurial client, for example, when performing a 'checkout' or 'update' action on a sub-repository within a malicious repository or a legitimate repository containing a malicious commit. (CVE-2017-1000116) Red Hat would like to thank the Mercurial Security Team for reporting CVE-2017-1000115 and the Subversion Team for reporting CVE-2017-1000116. Affected Software/OS: mercurial on Red Hat Enterprise Linux Server (v. 7) Solution: Please Install the Updated Packages. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2017-1000115 BugTraq ID: 100290 http://www.securityfocus.com/bid/100290 Debian Security Information: DSA-3963 (Google Search) http://www.debian.org/security/2017/dsa-3963 https://security.gentoo.org/glsa/201709-18 RedHat Security Advisories: RHSA-2017:2489 https://access.redhat.com/errata/RHSA-2017:2489 Common Vulnerability Exposure (CVE) ID: CVE-2017-1000116
Copyright	Copyright (C) 2017 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.