Commit 51bcdda

committed

docs(CHANGES): Detail CVE-2022-21187 for 0.11.1

1 parent 9f9626b commit 51bcddaCopy full SHA for 51bcdda

File tree

-1

lines changed

-1

lines changed

Lines changed: 7 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -6,12 +6,18 @@`
`6`	`6`
`7`	`7`	`## libvcs 0.11.1 (2022年03月12日)`
`8`	`8`
`9`		`-### Potential command injection via mercurial URLs`
	`9`	`+### CVE-2022-21187: Command Injection with mercurial repositories`
`10`	`10`
`11`	`11`	`- By setting a mercurial URL with an alias it is possible to execute arbitrary shell commands via`
`12`	`12`	`.obtain()` or in the case of uncloned destinations, `.update_repo()`. (#306, credit: Alessio
`13`	`13`	`Della Libera)`
`14`	`14`
	`15`	`+ See also:`
	`16`	`+`
	`17`	`+ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21187,`
	`18`	`+ https://nvd.nist.gov/vuln/detail/CVE-2022-21187`
	`19`	`+ - https://security.snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204`
	`20`	`+`
`15`	`21`	`### Development`
`16`	`22`
`17`	`23`	`- Run pyupgrade formatting (#305)`

Comments

(0)