CVE-2019-3902

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-22 · updated 2026-06-17
Weakness: CWE-22

Description

A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.

Affected products

Debian Linux: 8.0
mercurial: before 4.9 — fixed in 4.9
Red Hat Enterprise Linux: 7.0

How to fix

Upgrade to a fixed version: mercurial 4.9. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902
https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://usn.ubuntu.com/4086-1/
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902
https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://usn.ubuntu.com/4086-1/
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29

Get alerted when CVE-2019-3902 or the next vulnerability affects your stack