On Fri, Apr 24, 2015 at 01:21:56PM +0200, Moritz Muehlenhoff wrote: > Package: mercurial > Severity: important > Tags: security > > Please see > http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html > > Fix: > http://selenic.com/hg/rev/e3f30068d2eb
I've prepared a fix for this, find the diff attached. Can I upload it to stable-security? Cheers, Javi
Index: debian/changelog =================================================================== --- debian/changelog (revisión: 11645) +++ debian/changelog (copia de trabajo) @@ -1,3 +1,11 @@ +mercurial (3.1.2-2+deb8u1) stable-security; urgency=high + + * Fix "CVE-2014-9462" by adding patch + from_upstream__sshpeer_more_thorough_shell_quoting.patch + (Closes: #783237) + + -- Javi Merino <[email protected]> Fri, 01 May 2015 19:14:56 +0100 + mercurial (3.1.2-2) unstable; urgency=high * Fix "CVE-2014-9390: Errors in handling case-sensitive directories Index: debian/patches/series =================================================================== --- debian/patches/series (revisión: 11645) +++ debian/patches/series (copia de trabajo) @@ -12,3 +12,4 @@ from_upstream__encoding_add_hfsignoreclean_to_clean_out_HFS-ignored_characters.patch from_upstream__pathauditor_check_for_codepoints_ignored_on_OS_X.patch from_upstream__pathauditor_check_for_Windows_shortname_aliases.patch +from_upstream__sshpeer_more_thorough_shell_quoting.patch Index: debian/patches/from_upstream__sshpeer_more_thorough_shell_quoting.patch =================================================================== --- debian/patches/from_upstream__sshpeer_more_thorough_shell_quoting.patch (revisión: 0) +++ debian/patches/from_upstream__sshpeer_more_thorough_shell_quoting.patch (revisión: 11887) @@ -0,0 +1,31 @@ +Origin: http://selenic.com/hg/rev/e3f30068d2eb +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783237 +Description: sshpeer: more thorough shell quoting + This fixes CVE-2014-9462 +Applied-Upstream: 3.2.4 + +diff --git a/mercurial/sshpeer.py b/mercurial/sshpeer.py +--- a/mercurial/sshpeer.py ++++ b/mercurial/sshpeer.py +@@ -20,6 +20,8 @@ class remotelock(object): + self.release() + + def _serverquote(s): ++ if not s: ++ return s + '''quote a string for the remote shell ... which we assume is sh''' + if re.match('[a-zA-Z0-9@%_+=:,./-]*$', s): + return s +@@ -45,7 +47,10 @@ class sshpeer(wireproto.wirepeer): + sshcmd = self.ui.config("ui", "ssh", "ssh") + remotecmd = self.ui.config("ui", "remotecmd", "hg") + +- args = util.sshargs(sshcmd, self.host, self.user, self.port) ++ args = util.sshargs(sshcmd, ++ _serverquote(self.host), ++ _serverquote(self.user), ++ _serverquote(self.port)) + + if create: + cmd = '%s %s %s' % (sshcmd, args, +
signature.asc
Description: Digital signature
