RUSTSEC-2017-0003

Source
https://rustsec.org/advisories/RUSTSEC-2017-0003
Import Source
https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2017-0003.json
JSON Data
https://api.osv.dev/v1/vulns/RUSTSEC-2017-0003
Aliases
Published
2017-03-15T12:00:00Z
Modified
2023-11-08T03:59:16.345668Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Hostname verification skipped when custom root certs used
Details

If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate.

This issue was fixed by properly configuring the trust evaluation logic to perform that check.

Database specific
{
    "license": "CC0-1.0"
}
References

Affected packages

crates.io / security-framework

Package

Name
security-framework
View open source insights on deps.dev
Purl
pkg:cargo/security-framework

Affected ranges

Type
SEMVER
Events
Introduced
0.0.0-0
Fixed
0.1.12

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
    "informational": null,
    "categories": []
}