GitHub Advisoryadvisory · crates.io

GHSA-9xjr-m6f3-v5wm HTTPS MitM vulnerability due to lack of hostname verification

MEDIUM Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2016-10932
Ecosystem
crates.io
Packages
hyper
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-347
Reviewed
2021-08-19

Affected packages

• crates.io hyper: < 0.9.4 → fixed in 0.9.4

Description

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by leveraging rust-openssl's built-in support for hostname verification.

Related

Alias · CVE (1)

  • CVE-2016-10932 An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References