Mercurial Improper Certificate Validation vulnerability

MEDIUM 5.9CVE-2010-4237 · GHSA-7gf7-7wx4-mxmw · PYSEC-2026-665 · Published 29/10/2019 · updated 16/06/2026

In short

CVE-2010-4237 is a MEDIUM (CVSS 5.9) vulnerability affecting mercurial, mercurial (mercurial).
Chance of exploitation in the next 30 days (EPSS): 0.82%, higher than 57.3% of all vulnerabilities.
Fix: update to 1.6.4 or later.

Package	Affected versions	Patched versions
mercurial PyPI	`< 1.6.4`	`1.6.4`
mercurial mercurial	`< 1.6.4`	`1.6.4`

Description

Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2010-4237 · ADVISORY
dscho/hg commit 4ea63fb · WEB
dscho/hg commit 89baabf · WEB
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
bz.mercurial-scm.org/show_bug.cgi · WEB
repo.mercurial-scm.org/hg/rev/6ab4a7d3c179 · WEB
repo.mercurial-scm.org/hg/rev/f2937d6492c5 · WEB
security-tracker.debian.org/tracker/CVE-2010-4237 · WEB
pypi.org/project/mercurial · PACKAGE
GitHub Advisory GHSA-7gf7-7wx4-mxmw · ADVISORY

More vulnerabilities in mercurial

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mercurial

PyPI

< 1.6.4

1.6.4

mercurial

< 1.6.4

1.6.4

Description

NVD description

More vulnerabilities in mercurial

See all →