GitHub Advisoryadvisory · crates.io

GHSA-jqqr-c2r2-9cvr Improper Certificate Validation in security-framework

MEDIUM Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2017-18588
Ecosystem
crates.io
Packages
security-framework
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-295
Reviewed
2021-08-19

Affected packages

• crates.io security-framework: < 0.1.12 → fixed in 0.1.12

Description

If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.

Related

Alias · CVE (1)

  • CVE-2017-18588 An issue was discovered in the security-framework crate before 0.1.12 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References