GitHub Advisoryadvisory · crates.io

GHSA-34p9-f4q3-c4r7 Improper Certificate Validation in openssl

HIGH Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2016-10931
Ecosystem
crates.io
Packages
openssl
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295
Reviewed
2021-08-19

Affected packages

• crates.io openssl: < 0.9.0 → fixed in 0.9.0

Description

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks. The problem was addressed in newer versions by enabling certificate verification by default and exposing APIs to perform hostname verification. Use the SslConnector and SslAcceptor types to take advantage of these new features (as opposed to the lower-level SslContext type).

Related

Alias · CVE (1)

  • CVE-2016-10931 An issue was discovered in the openssl crate before 0.9.0 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References