CVE-2010-4237
Fixed in a distro release EPSS <1%
Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
Products: mercurial
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mercurial | 1.6.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mercurial | 1.6.4-1 |
| Debian 13 | mercurial | 1.6.4-1 |
| Debian 14 | mercurial | 1.6.4-1 |