View at Official suse advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2019-3902 severity moderate: SUSE including 15 source package names (mercurial-2.8.2-15.18.4, mercurial-4.5.2-3.9.44, …), 18 product×package rows across 13 product lines (SUSE Linux Enterprise Module for Basesystem 15 SP4, SUSE Linux Enterprise Module for Basesystem 15 SP5, … (13 product lines)): Fixed 18.
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.