Accepted mercurial 3.1.2-2+deb8u7 (source all amd64) into oldstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Thu, 25 Apr 2019 17:40:16 +0100
Source: mercurial
Binary: mercurial-common mercurial
Built-For-Profiles: nocheck
Architecture: source all amd64
Version: 3.1.2-2+deb8u7
Distribution: jessie-security
Urgency: high
Maintainer: Python Applications Packaging Team <python-apps-team@lists.alioth.debian.org>
Changed-By: Chris Lamb <lamby@debian.org>
Description:
mercurial - easy-to-use, scalable distributed version control system
mercurial-common - easy-to-use, scalable distributed version control system (common
Closes: 927674
Changes:
mercurial (3.1.2-2+deb8u7) jessie-security; urgency=high
.
* CVE-2019-3902: Fix a vulnerability where symlinks and subrepositories could
be used defeat Mercurial's path-checking logic and write files outside the
repository root. (Closes: #927674)
Checksums-Sha1:
71fb9767e4ccb180e1bff0690468e5398a7afdf2 2287 mercurial_3.1.2-2+deb8u7.dsc
ae7e16454cee505da895c2497f09711f35287459 3983825 mercurial_3.1.2.orig.tar.gz
33ef3c7e89279f442e67dd288a1223e8e16f6757 74408 mercurial_3.1.2-2+deb8u7.debian.tar.xz
b61dbc4cd0508f6be3d1d6b9fa4e6a141a001e28 1603822 mercurial-common_3.1.2-2+deb8u7_all.deb
6718d12326c48e6536b55e99bd7dce6c6ff62826 61210 mercurial_3.1.2-2+deb8u7_amd64.deb
Checksums-Sha256:
33a015ea156747c770ca254e17b9871c779db15be9e6b6aa679d7496140bce28 2287 mercurial_3.1.2-2+deb8u7.dsc
5dbe5ceb3707e378528dc9346af280919760aa1a8bcc27be12c1fe2bafa78d3a 3983825 mercurial_3.1.2.orig.tar.gz
5193356d426b700e7d402eb9e591c729ecf59567f28234c87a5a664cf8769678 74408 mercurial_3.1.2-2+deb8u7.debian.tar.xz
49c649ab34e43dd1d0f240c1f7b9a0948504892f4652d9b93016699863afdf84 1603822 mercurial-common_3.1.2-2+deb8u7_all.deb
d5b218cb9a81fabd78d9b44407965a9a04b3f0d19438fce47f13c2ffbbf1409a 61210 mercurial_3.1.2-2+deb8u7_amd64.deb
Files:
439ab7a28cd40b0599967526a240b864 2287 vcs optional mercurial_3.1.2-2+deb8u7.dsc
72a79798de828d6d6fb055273f91201a 3983825 vcs optional mercurial_3.1.2.orig.tar.gz
ae041d2817a6c42f1635774352d7ba99 74408 vcs optional mercurial_3.1.2-2+deb8u7.debian.tar.xz
22b2330c21d572463b67b60112e0b8f7 1603822 vcs optional mercurial-common_3.1.2-2+deb8u7_all.deb
319044abec627c78535fbe80fac9e3e0 61210 vcs optional mercurial_3.1.2-2+deb8u7_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAlzB7j0ACgkQHpU+J9Qx
HlimOxAAuRzWeE3tWOBHJHv4W8jJNG++FlguAqPYwxnA+ders2GvPbqubNyZ63iN
g2a+w7Hvefz6SgW55OWce7NjLrnQFx4t3mp+7xGYFNtlUpsIf5ZLJD1TlHOvm2nC
5lJ3wDAdxAW86zia1TRvF+xsAsnMMYRhG2nyy7kll+2iOXnvGCIjEF6jNN+QU0V7
AN3yl37P9E5b8utKrSjXnI5ohfn+p548EMVNKtZgenIu367RDvsEtY3WxsrNHSQy
xRu6NdHHkhrxj9NWX3Jy2Xh8ReEVrnW7tlJFYDTNkIso9pEWlkDNNHgOx0VYIlj2
U0nBdXGg+SD7OzSMj/aNppjrDVGVjkX7wl4Tecsz9KeWAf83o+FQhRkiUNlNRN5f
C5ALCVP9O3txYqZ5iIyR57K+DRd0BLl0YNHvvKTNeczxTtQvBrXB2WBFD8+Yf6SN
xQJGsqPcv3SARMNng7wwocB/OL2t0mE5V7ZSsq7NkxtqBo50NIo5ndkXVPCbjBxu
b8IrcbwFoBP1XHroCIDFcJjuOAqVriF+88nRKmYYLlO4GTzDrk/rBU2dnu1s4Uwz
f8j0jaV6XX8hBn5cn1lMlZCcKFeStin0jJl+yaltmF0CGfcwVwTN3dlk0tPEUGDy
n56yYbZAOEnA3wtFtxiiYqJkJO5wXnZjYnNBcQ4C7f0JVqifLlM=
=BZIK
-----END PGP SIGNATURE-----