PT-2019-6582 · Mercurial · Mercurial

Dave B · Publicado 2019-10-29 · Atualizado 2022-04-21 · CVE-2010-4237

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 1.6.4

Description The issue allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack due to the failure to verify the Common Name field of SSL certificates.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2010-4237

GHSA-7GF7-7WX4-MXMW

Produtos afetados

Mercurial

Referências · 14

• https://github.com/dscho/hg/commit/89baabf4fb7abf30ef6fdcf3d455a7893e5cc145 · Nota
• https://github.com/dscho/hg/commit/4ea63fb25ceeeaaa4cd1026f733b7ea7672c30b3 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4237 · Nota
• https://repo.mercurial-scm.org/hg/rev/6ab4a7d3c179 · Nota
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-4237 · Aviso do Fabricante
• https://t.me/cibsecurity/7748 · Publicação no Telegram
• https://bz.mercurial-scm.org/show_bug.cgi?id=2407 · Aviso do Fabricante
• https://repo.mercurial-scm.org/hg/rev/f2937d6492c5 · Nota
• https://osv.dev/vulnerability/GHSA-7gf7-7wx4-mxmw · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237 · Nota
• https://osv.dev/vulnerability/CVE-2010-4237 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-4237 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4237 · Aviso do Fabricante