aports issueshttps://gitlab.alpinelinux.org/alpine/aports/-/issues2019-12-05T06:22:13Zhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8844kodi: Persistent Cross-Site Scripting (CVE-2018-8831)2019-12-05T06:22:13ZAlicha CHkodi: Persistent Cross-Site Scripting (CVE-2018-8831)A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through
17.6 that allows the execution
of arbitrary HTML/script code in the context of the victim user’s
browser via a playlist.
### References:
http://seclists.org/fulldi...A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through
17.6 that allows the execution
of arbitrary HTML/script code in the context of the victim user’s
browser via a playlist.
### References:
http://seclists.org/fulldisclosure/2018/Apr/36
https://nvd.nist.gov/vuln/detail/CVE-2018-8831
*(from redmine: issue id 8844, created on 2018-04-26)*
* Relations:
* copied_to #8845
* copied_to #8846
* child #8845
* child #8846Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8843plugdev system group is missing2019-12-05T06:20:28ZTaner Tasplugdev system group is missingSome packages like networkmanager, modemmanager, udevil are using
“plugdev” group to run fully functional.
But this group is missing on Alpine base installation.
We can add this group with:
- eudev package post-install/upgrade scri...Some packages like networkmanager, modemmanager, udevil are using
“plugdev” group to run fully functional.
But this group is missing on Alpine base installation.
We can add this group with:
- eudev package post-install/upgrade script
- alpine-baselayout with port-upgrade script for existing
installations.
example post-install/upgrade:
https://github.com/alpinelinux/aports/blob/master/community/udevil/udevil.pre-install
*(from redmine: issue id 8843, created on 2018-04-26)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/8842[3.7] drupal7: Remote Code Execution (CVE-2018-7602)2019-07-23T11:32:08ZAlicha CH[3.7] drupal7: Remote Code Execution (CVE-2018-7602)A remote code execution vulnerability exists within multiple subsystems
of Drupal 7.x and 8.x. This potentially allows attackers
to exploit multiple attack vectors on a Drupal site, which could result
in the site being compromised. Thi...A remote code execution vulnerability exists within multiple subsystems
of Drupal 7.x and 8.x. This potentially allows attackers
to exploit multiple attack vectors on a Drupal site, which could result
in the site being compromised. This vulnerability is related
to Drupal core - Highly critical - Remote Code Execution -
SA-CORE-2018-002. Both SA-CORE-2018-002 and
this vulnerability are being exploited in the wild.
### Fixed In Version:
Drupal 7.59
### Reference:
https://www.drupal.org/sa-core-2018-004
### Patch:
https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0
*(from redmine: issue id 8842, created on 2018-04-26, closed on 2018-06-12)*
* Relations:
* copied_to #8840
* parent #88403.7.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/8841[3.8] drupal7: Remote Code Execution (CVE-2018-7602)2019-09-13T12:49:50ZAlicha CH[3.8] drupal7: Remote Code Execution (CVE-2018-7602)A remote code execution vulnerability exists within multiple subsystems
of Drupal 7.x and 8.x. This potentially allows attackers
to exploit multiple attack vectors on a Drupal site, which could result
in the site being compromised. Thi...A remote code execution vulnerability exists within multiple subsystems
of Drupal 7.x and 8.x. This potentially allows attackers
to exploit multiple attack vectors on a Drupal site, which could result
in the site being compromised. This vulnerability is related
to Drupal core - Highly critical - Remote Code Execution -
SA-CORE-2018-002. Both SA-CORE-2018-002 and
this vulnerability are being exploited in the wild.
### Fixed In Version:
Drupal 7.59
### Reference:
https://www.drupal.org/sa-core-2018-004
### Patch:
https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0
*(from redmine: issue id 8841, created on 2018-04-26, closed on 2018-06-12)*
* Relations:
* copied_to #8840
* parent #88403.8.0https://gitlab.alpinelinux.org/alpine/aports/-/issues/8840drupal7: Remote Code Execution (CVE-2018-7602)2019-07-23T11:32:09ZAlicha CHdrupal7: Remote Code Execution (CVE-2018-7602)A remote code execution vulnerability exists within multiple subsystems
of Drupal 7.x and 8.x. This potentially allows attackers
to exploit multiple attack vectors on a Drupal site, which could result
in the site being compromised. Thi...A remote code execution vulnerability exists within multiple subsystems
of Drupal 7.x and 8.x. This potentially allows attackers
to exploit multiple attack vectors on a Drupal site, which could result
in the site being compromised. This vulnerability is related
to Drupal core - Highly critical - Remote Code Execution -
SA-CORE-2018-002. Both SA-CORE-2018-002 and
this vulnerability are being exploited in the wild.
### Fixed In Version:
Drupal 7.59
### Reference:
https://www.drupal.org/sa-core-2018-004
### Patch:
https://cgit.drupalcode.org/drupal/rawdiff/?h=7.x&id=080daa38f265ea28444c540832509a48861587d0
*(from redmine: issue id 8840, created on 2018-04-26, closed on 2018-06-12)*
* Relations:
* copied_to #8841
* copied_to #8842
* child #8841
* child #8842https://gitlab.alpinelinux.org/alpine/aports/-/issues/8839Hope to support the Percona database2021-07-27T14:21:51Zrobert yuHope to support the Percona databaseHope to support the Percona database
*(from redmine: issue id 8839, created on 2018-04-25)*Hope to support the Percona database
*(from redmine: issue id 8839, created on 2018-04-25)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/8838consul init script2019-07-23T11:32:10Zfra giaconsul init scriptconsul syntax for config validation changed from:
<code class="text">
consul configtest -config-dir /etc/consul
</code>
to
<code class="text">
consul validate /etc/consul
</code>
*(from redmine: issue id 8...consul syntax for config validation changed from:
<code class="text">
consul configtest -config-dir /etc/consul
</code>
to
<code class="text">
consul validate /etc/consul
</code>
*(from redmine: issue id 8838, created on 2018-04-25, closed on 2018-06-26)*
* Changesets:
* Revision a6471d540b46ad1a76fcaad306a59929be147ecd by Francesco Colista on 2018-06-06T10:38:05Z:
```
testing/consul: upgrade to 1.1.0. Fixed init.d, Fixes #8838.
According with https://www.consul.io/docs/commands/validate.html the checkconfig
in the init.d script should have been fixed.
```3.8.0Francesco ColistaFrancesco Colistahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8837SBCL built without extensions2019-07-23T10:51:00ZPelle HjekSBCL built without extensionsSBCL has been built without extensions and therefore fails to load
Quicklisp:
$ sbcl
While evaluating the form starting at line 129, column 0
of #P"/home/pelle/quicklisp/setup.lisp":
debugger invoked on a SB-INT:EXTEN...SBCL has been built without extensions and therefore fails to load
Quicklisp:
$ sbcl
While evaluating the form starting at line 129, column 0
of #P"/home/pelle/quicklisp/setup.lisp":
debugger invoked on a SB-INT:EXTENSION-FAILURE:
Don't know how to REQUIRE SB-BSD-SOCKETS.
See also:
The SBCL Manual, Variable SB-EXT:*MODULE-PROVIDER-FUNCTIONS*
The SBCL Manual, Function REQUIRE
To fix this, <code>make.sh</code> would have to be run with the
<code>—fancy</code> flag.
*(from redmine: issue id 8837, created on 2018-04-24)*https://gitlab.alpinelinux.org/alpine/aports/-/issues/8836[3.7] mbedtls: Multiple vulnerabilities (CVE-2017-18187, CVE-2018-0487, CVE-2...2019-07-23T11:32:11ZAlicha CH[3.7] mbedtls: Multiple vulnerabilities (CVE-2017-18187, CVE-2018-0487, CVE-2018-0488)CVE-2017-18187: Bounds-check bypass via integer overflow in ssl\_srv.c:ssl\_parse\_client\_psk\_identity()
----------------------------------------------------------------------------------------------------------
In ARM mbed TLS before...CVE-2017-18187: Bounds-check bypass via integer overflow in ssl\_srv.c:ssl\_parse\_client\_psk\_identity()
----------------------------------------------------------------------------------------------------------
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an
integer overflow in PSK
identity parsing in the ssl\_parse\_client\_psk\_identity() function in
library/ssl\_srv.c.
### Fixed In Version:
mbedtls 2.7.0
### References:
https://nvd.nist.gov/vuln/detail/CVE-2017-18187
### Patch:
https://github.com/ARMmbed/mbedtls/commit/83c9f495ffe70c7dd280b41fdfd4881485a3bc28
CVE-2018-0487: Risk of remote code execution when verifying RSASSA-PSS signatures
---------------------------------------------------------------------------------
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows
remote attackers to execute arbitrary
code or cause a denial of service (buffer overflow) via a crafted
certificate chain that is mishandled during
RSASSA-PSS signature verification within a TLS or DTLS session.
### Fixed In Version:
mbedtls 1.3.22, mbedtls 2.1.10, mbedtls 2.7.0
### References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
https://nvd.nist.gov/vuln/detail/CVE-2018-0487
### Patch:
https://github.com/ARMmbed/mbedtls/commit/28a0c727957990ac655cbe40c7eb20b7ef01167d
CVE-2018-0488: Risk of remote code execution when truncated HMAC is enabled
---------------------------------------------------------------------------
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the
truncated HMAC extension and CBC are used,
allows remote attackers to execute arbitrary code or cause a denial of
service (heap corruption) via a crafted application
packet within a TLS or DTLS session.
### Fixed In Version:
mbedtls 1.3.22, mbedtls 2.1.10, mbedtls 2.7.0
### References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
https://nvd.nist.gov/vuln/detail/CVE-2018-0488
### Patches:
https://github.com/ARMmbed/mbedtls/commit/992b6872f3ca717282ae367749a47f006d337a87
https://github.com/ARMmbed/mbedtls/commit/464147cadc694379b7717afb7b517fe05cdb323f
*(from redmine: issue id 8836, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8834
* parent #88343.7.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8835[3.8] mbedtls: Multiple vulnerabilities (CVE-2017-18187, CVE-2018-0487, CVE-2...2019-07-23T11:32:12ZAlicha CH[3.8] mbedtls: Multiple vulnerabilities (CVE-2017-18187, CVE-2018-0487, CVE-2018-0488)CVE-2017-18187: Bounds-check bypass via integer overflow in ssl\_srv.c:ssl\_parse\_client\_psk\_identity()
----------------------------------------------------------------------------------------------------------
In ARM mbed TLS before...CVE-2017-18187: Bounds-check bypass via integer overflow in ssl\_srv.c:ssl\_parse\_client\_psk\_identity()
----------------------------------------------------------------------------------------------------------
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an
integer overflow in PSK
identity parsing in the ssl\_parse\_client\_psk\_identity() function in
library/ssl\_srv.c.
### Fixed In Version:
mbedtls 2.7.0
### References:
https://nvd.nist.gov/vuln/detail/CVE-2017-18187
### Patch:
https://github.com/ARMmbed/mbedtls/commit/83c9f495ffe70c7dd280b41fdfd4881485a3bc28
CVE-2018-0487: Risk of remote code execution when verifying RSASSA-PSS signatures
---------------------------------------------------------------------------------
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows
remote attackers to execute arbitrary
code or cause a denial of service (buffer overflow) via a crafted
certificate chain that is mishandled during
RSASSA-PSS signature verification within a TLS or DTLS session.
### Fixed In Version:
mbedtls 1.3.22, mbedtls 2.1.10, mbedtls 2.7.0
### References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
https://nvd.nist.gov/vuln/detail/CVE-2018-0487
### Patch:
https://github.com/ARMmbed/mbedtls/commit/28a0c727957990ac655cbe40c7eb20b7ef01167d
CVE-2018-0488: Risk of remote code execution when truncated HMAC is enabled
---------------------------------------------------------------------------
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the
truncated HMAC extension and CBC are used,
allows remote attackers to execute arbitrary code or cause a denial of
service (heap corruption) via a crafted application
packet within a TLS or DTLS session.
### Fixed In Version:
mbedtls 1.3.22, mbedtls 2.1.10, mbedtls 2.7.0
### References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
https://nvd.nist.gov/vuln/detail/CVE-2018-0488
### Patches:
https://github.com/ARMmbed/mbedtls/commit/992b6872f3ca717282ae367749a47f006d337a87
https://github.com/ARMmbed/mbedtls/commit/464147cadc694379b7717afb7b517fe05cdb323f
*(from redmine: issue id 8835, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8834
* parent #8834
* Changesets:
* Revision 44a52d56ef47740226463f2fba905f0ccfee8b03 on 2018-06-11T14:20:36Z:
```
community/mbedtls: security upgrade to 2.7.0
CVE-2017-18187, CVE-2018-0487, CVE-2018-0488
Fixes #8835
```3.8.0Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8834mbedtls: Multiple vulnerabilities (CVE-2017-18187, CVE-2018-0487, CVE-2018-0488)2019-07-23T11:32:13ZAlicha CHmbedtls: Multiple vulnerabilities (CVE-2017-18187, CVE-2018-0487, CVE-2018-0488)CVE-2017-18187: Bounds-check bypass via integer overflow in ssl\_srv.c:ssl\_parse\_client\_psk\_identity()
----------------------------------------------------------------------------------------------------------
In ARM mbed TLS before...CVE-2017-18187: Bounds-check bypass via integer overflow in ssl\_srv.c:ssl\_parse\_client\_psk\_identity()
----------------------------------------------------------------------------------------------------------
In ARM mbed TLS before 2.7.0, there is a bounds-check bypass through an
integer overflow in PSK
identity parsing in the ssl\_parse\_client\_psk\_identity() function in
library/ssl\_srv.c.
### Fixed In Version:
mbedtls 2.7.0
### References:
https://nvd.nist.gov/vuln/detail/CVE-2017-18187
### Patch:
https://github.com/ARMmbed/mbedtls/commit/83c9f495ffe70c7dd280b41fdfd4881485a3bc28
CVE-2018-0487: Risk of remote code execution when verifying RSASSA-PSS signatures
---------------------------------------------------------------------------------
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows
remote attackers to execute arbitrary
code or cause a denial of service (buffer overflow) via a crafted
certificate chain that is mishandled during
RSASSA-PSS signature verification within a TLS or DTLS session.
### Fixed In Version:
mbedtls 1.3.22, mbedtls 2.1.10, mbedtls 2.7.0
### References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
https://nvd.nist.gov/vuln/detail/CVE-2018-0487
### Patch:
https://github.com/ARMmbed/mbedtls/commit/28a0c727957990ac655cbe40c7eb20b7ef01167d
CVE-2018-0488: Risk of remote code execution when truncated HMAC is enabled
---------------------------------------------------------------------------
ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the
truncated HMAC extension and CBC are used,
allows remote attackers to execute arbitrary code or cause a denial of
service (heap corruption) via a crafted application
packet within a TLS or DTLS session.
### Fixed In Version:
mbedtls 1.3.22, mbedtls 2.1.10, mbedtls 2.7.0
### References:
https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01
https://nvd.nist.gov/vuln/detail/CVE-2018-0488
### Patches:
https://github.com/ARMmbed/mbedtls/commit/992b6872f3ca717282ae367749a47f006d337a87
https://github.com/ARMmbed/mbedtls/commit/464147cadc694379b7717afb7b517fe05cdb323f
*(from redmine: issue id 8834, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8835
* copied_to #8836
* child #8835
* child #8836Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8833[3.4] memcached: UDP server support allows spoofed traffic amplification DoS ...2019-07-23T11:32:15ZAlicha CH[3.4] memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffi...Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffic amplification
of 1:50,000 has been reported by reliable sources). This attack appear
to be exploitable via network connectivity to port 11211 UDP.
### Fixed In Version:
memcached 1.5.6
### References:
http://openwall.com/lists/oss-security/2018/03/07/3
https://nvd.nist.gov/vuln/detail/CVE-2018-1000115
### Patch:
https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
*(from redmine: issue id 8833, created on 2018-04-24, closed on 2018-06-12)*
* Relations:
* copied_to #8830
* parent #8830
* Changesets:
* Revision dcdf3ad355958a452c9942c010966d9316245cf2 on 2018-06-11T13:07:04Z:
```
main/memcached: security fix (CVE-2018-1000115)
Fixes #8833
```3.4.7Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8832[3.5] memcached: UDP server support allows spoofed traffic amplification DoS ...2019-07-23T11:32:16ZAlicha CH[3.5] memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffi...Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffic amplification
of 1:50,000 has been reported by reliable sources). This attack appear
to be exploitable via network connectivity to port 11211 UDP.
### Fixed In Version:
memcached 1.5.6
### References:
http://openwall.com/lists/oss-security/2018/03/07/3
https://nvd.nist.gov/vuln/detail/CVE-2018-1000115
### Patch:
https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
*(from redmine: issue id 8832, created on 2018-04-24, closed on 2018-06-12)*
* Relations:
* copied_to #8830
* parent #8830
* Changesets:
* Revision ffbc207515e6c9e7c3184fb12c1ae8b8e5596a9e on 2018-06-11T13:03:55Z:
```
main/memcached: security fix (CVE-2018-1000115)
Fixes #8832
```3.5.3Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8831[3.6] memcached: UDP server support allows spoofed traffic amplification DoS ...2019-07-23T11:32:17ZAlicha CH[3.6] memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffi...Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffic amplification
of 1:50,000 has been reported by reliable sources). This attack appear
to be exploitable via network connectivity to port 11211 UDP.
### Fixed In Version:
memcached 1.5.6
### References:
http://openwall.com/lists/oss-security/2018/03/07/3
https://nvd.nist.gov/vuln/detail/CVE-2018-1000115
### Patch:
https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
*(from redmine: issue id 8831, created on 2018-04-24, closed on 2018-06-12)*
* Relations:
* copied_to #8830
* parent #8830
* Changesets:
* Revision 7d7779942382377d33d88d0d7c09b0444dfc398e on 2018-06-11T13:00:50Z:
```
main/memcached: security fix (CVE-2018-1000115)
Fixes #8831
```3.6.3Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8830memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2...2019-09-13T12:49:50ZAlicha CHmemcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffi...Memcached version 1.5.5 contains an Insufficient Control of Network
Message Volume (Network Amplification, CWE-406)
vulnerability in the UDP support of the memcached server that can result
in denial of service via network flood (traffic amplification
of 1:50,000 has been reported by reliable sources). This attack appear
to be exploitable via network connectivity to port 11211 UDP.
### Fixed In Version:
memcached 1.5.6
### References:
http://openwall.com/lists/oss-security/2018/03/07/3
https://nvd.nist.gov/vuln/detail/CVE-2018-1000115
### Patch:
https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
*(from redmine: issue id 8830, created on 2018-04-24, closed on 2018-07-19)*
* Relations:
* copied_to #8831
* copied_to #8832
* copied_to #8833
* child #8831
* child #8832
* child #8833Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8829[3.4] mercurial: HTTP server permissions bypass (CVE-2018-1000132)2019-07-23T11:32:19ZAlicha CH[3.4] mercurial: HTTP server permissions bypass (CVE-2018-1000132)All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access...All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access.
Wire protocol commands that didn’t explicitly declare their permissions
had no permissions checking done.
The web.{allow-pull, allow-push, deny\_read, etc} config options
governing access control were never consulted
when running these commands. This allowed permissions bypass for
impacted commands.
The batch wire protocol command did not list its permission requirements
nor did it enforce permissions on individual sub-commands.
### References:
https://www.mercurial-scm.org/wiki/WhatsNew\#Mercurial\_4.5.1*.2F\_4.5.2*.282018-03-06.29
### Patch:
https://www.mercurial-scm.org/repo/hg/rev/2ecb0fc535b1
*(from redmine: issue id 8829, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8825
* parent #88253.4.7Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8828[3.5] mercurial: HTTP server permissions bypass (CVE-2018-1000132)2019-07-23T11:32:19ZAlicha CH[3.5] mercurial: HTTP server permissions bypass (CVE-2018-1000132)All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access...All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access.
Wire protocol commands that didn’t explicitly declare their permissions
had no permissions checking done.
The web.{allow-pull, allow-push, deny\_read, etc} config options
governing access control were never consulted
when running these commands. This allowed permissions bypass for
impacted commands.
The batch wire protocol command did not list its permission requirements
nor did it enforce permissions on individual sub-commands.
### References:
https://www.mercurial-scm.org/wiki/WhatsNew\#Mercurial\_4.5.1*.2F\_4.5.2*.282018-03-06.29
### Patch:
https://www.mercurial-scm.org/repo/hg/rev/2ecb0fc535b1
*(from redmine: issue id 8828, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8825
* parent #8825
* Changesets:
* Revision fd5d18f37e7b143d103323cc6850506536fcf0ac by Natanael Copa on 2018-07-30T07:55:25Z:
```
main/mercurial: security upgrade to 4.5.2 (CVE-2018-1000132)
fixes #8828
```3.5.3Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8827[3.6] mercurial: HTTP server permissions bypass (CVE-2018-1000132)2019-07-23T11:32:21ZAlicha CH[3.6] mercurial: HTTP server permissions bypass (CVE-2018-1000132)All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access...All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access.
Wire protocol commands that didn’t explicitly declare their permissions
had no permissions checking done.
The web.{allow-pull, allow-push, deny\_read, etc} config options
governing access control were never consulted
when running these commands. This allowed permissions bypass for
impacted commands.
The batch wire protocol command did not list its permission requirements
nor did it enforce permissions on individual sub-commands.
### References:
https://www.mercurial-scm.org/wiki/WhatsNew\#Mercurial\_4.5.1*.2F\_4.5.2*.282018-03-06.29
### Patch:
https://www.mercurial-scm.org/repo/hg/rev/2ecb0fc535b1
*(from redmine: issue id 8827, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8825
* parent #8825
* Changesets:
* Revision d5a8238bf36d48e617f3b48558be114ca2c788d8 by Natanael Copa on 2018-07-30T07:53:40Z:
```
main/mercurial: security upgrade to 4.5.2 (CVE-2018-1000132)
fixes #8827
```3.6.3Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8826[3.7] mercurial: HTTP server permissions bypass (CVE-2018-1000132)2019-07-23T11:32:22ZAlicha CH[3.7] mercurial: HTTP server permissions bypass (CVE-2018-1000132)All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access...All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access.
Wire protocol commands that didn’t explicitly declare their permissions
had no permissions checking done.
The web.{allow-pull, allow-push, deny\_read, etc} config options
governing access control were never consulted
when running these commands. This allowed permissions bypass for
impacted commands.
The batch wire protocol command did not list its permission requirements
nor did it enforce permissions on individual sub-commands.
### References:
https://www.mercurial-scm.org/wiki/WhatsNew\#Mercurial\_4.5.1*.2F\_4.5.2*.282018-03-06.29
### Patch:
https://www.mercurial-scm.org/repo/hg/rev/2ecb0fc535b1
*(from redmine: issue id 8826, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8825
* parent #8825
* Changesets:
* Revision 1e8949049413dd8713037a019c1d834ed4c00aba by Natanael Copa on 2018-07-30T07:51:46Z:
```
main/mercurial: security upgrade to 4.5.2 (CVE-2018-1000132)
fixes #8826
```3.7.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8825mercurial: HTTP server permissions bypass (CVE-2018-1000132)2019-07-23T11:32:23ZAlicha CHmercurial: HTTP server permissions bypass (CVE-2018-1000132)All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access...All versions of Mercurial prior to 4.5.2 have vulnerabilities in the
HTTP server that allow permissions bypass to:
Perform writes on repositories that should be read-only.
Perform reads on repositories that shouldn’t allow read access.
Wire protocol commands that didn’t explicitly declare their permissions
had no permissions checking done.
The web.{allow-pull, allow-push, deny\_read, etc} config options
governing access control were never consulted
when running these commands. This allowed permissions bypass for
impacted commands.
The batch wire protocol command did not list its permission requirements
nor did it enforce permissions on individual sub-commands.
### References:
https://www.mercurial-scm.org/wiki/WhatsNew\#Mercurial\_4.5.1*.2F\_4.5.2*.282018-03-06.29
### Patch:
https://www.mercurial-scm.org/repo/hg/rev/2ecb0fc535b1
*(from redmine: issue id 8825, created on 2018-04-24, closed on 2018-07-30)*
* Relations:
* copied_to #8826
* copied_to #8827
* copied_to #8828
* copied_to #8829
* child #8826
* child #8827
* child #8828
* child #8829Natanael CopaNatanael Copa