Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote
    attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle
    attack. (CVE-2010-4237)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote     attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle     attack. (CVE-2010-4237)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update of mercurial improves the SSL certificate validation process. CVE-2010-4237: CVSS v2 Base Score: 4.3 (moderate) (AV:N/AC:M/Au:N/C:N/I:P/A:N)

ID	Name	Product	Family	Type	Severity
432213	SCA: security update for mercurial (GHSA-7gf7-7wx4-mxmw)	Tenable Cloud Security	SCA Checks	Local	medium
432213	SCA: security update for mercurial (GHSA-7gf7-7wx4-mxmw)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
217420	Linux Distros Unpatched Vulnerability : CVE-2010-4237	Nessus	Misc.	Local	medium
75643	openSUSE Security Update : mercurial (openSUSE-SU-2010:1029-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2010-4237

medium

Tenable Plugins

medium

medium

medium

high