What is GHSA-3mjj-mr4f-qxmx?

GHSA-3mjj-mr4f-qxmx is a security advisory published by GitHub Security Advisories with Critical severity. Mercurial mishandles integer addition and subtraction

Which CVE IDs does GHSA-3mjj-mr4f-qxmx cover?

GHSA-3mjj-mr4f-qxmx covers the following CVE IDs: CVE-2018-13347. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3mjj-mr4f-qxmx?

GHSA-3mjj-mr4f-qxmx has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-3mjj-mr4f-qxmx?

GHSA-3mjj-mr4f-qxmx affects 1 product, including: pip/mercurial:\u003c 4.6.1.

GHSA-3mjj-mr4f-qxmxCriticalCVSS 9.8

Mercurial mishandles integer addition and subtraction

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

September 25, 2024

🔗 CVE IDs covered (1)

CVE-2018-13347 →

📋 Description

mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

🎯 Affected products1

pip/mercurial:< 4.6.1

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2018-13347
https://access.redhat.com/errata/RHSA-2019:2276
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://www.mercurial-scm.org/repo/hg-committed/log?rev=modifies%28%22mercurial%2Fmpatch.c%22%29+and+4.5%3A%3A
https://www.mercurial-scm.org/repo/hg/rev/1acfc35d478c
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-89.yaml
https://github.com/advisories/GHSA-3mjj-mr4f-qxmx