Use of PuTTY / pageant, CVE-2024-3149

[Henkel, Dirk]

Dear TortoiseHg devs,

reading about the PuTTY vulnerability CVE-2024-3149, I found the version
control frontends TortoiseGit and TortoiseSVN in the list of affected
programs, but not (yet) TortoiseHg, although TortoiseHg also includes
the PuTTY tool "pageant".

So should TortoiseHg also be included in the list of the
PuTTY-downstream projects affected by CVE-2024-3149?
Or is the use of the "pageant" tool in TortoiseHg so different from that
in f.i. TortoiseGit that TortoiseHg is not affected by CVE-2024-3149?

Best regards,
Dirk Henkel

[Matt Harbison]

It looks like TortoiseHg bundled plink from TortoiseGit and Pagent awhile ago[1].  No idea if these versions are affected, but we should probably update just because it's been awhile.

[1] https://foss.heptapod.net/mercurial/tortoisehg/thg-winbuild/-/commit/7a58314826e1eb527a450cb28a7b18feaea89201