CVE-2019-3902

Name	CVE-2019-3902
Description	A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1764-1, DLA-2293-1
Debian Bugs	927674

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mercurial (PTS)	buster	4.8.2-1+deb10u1	fixed
	bullseye	5.6.1-4	fixed
	bookworm	6.3.2-1	fixed
	trixie	6.4.4-2	fixed
	sid	6.5.2-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
mercurial	source	jessie	3.1.2-2+deb8u7	DLA-1764-1
mercurial	source	stretch	4.0-1+deb9u2	DLA-2293-1
mercurial	source	buster	4.8.2-1+deb10u1
mercurial	source	(unstable)	4.9-1		927674

Notes

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29
https://www.mercurial-scm.org/repo/hg/rev/6c10eba6b9cd
https://www.mercurial-scm.org/repo/hg/rev/31286c9282df
https://www.mercurial-scm.org/repo/hg/rev/83377b4b4ae0