PT-2016-4588 · Rust · Hyper

Publicado 2016-05-09 · Atualizado 2021-08-25 · CVE-2016-10932

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions hyper crate versions prior to 0.9.4

Description An issue was discovered in the hyper crate for Rust on Windows, allowing an HTTPS man-in-the-middle attack because hostname verification was omitted. This enables an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch.

Recommendations For versions prior to 0.9.4, update to version 0.9.4 or later to address the issue by leveraging rust-openssl's built-in support for hostname verification.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-254

CWE-347

Identificadores relacionados

CVE-2016-10932

GHSA-9XJR-M6F3-V5WM

RUSTSEC-2016-0002

Produtos afetados

Hyper

Referências · 10

• https://github.com/hyperium/hyper/issues/472 · Nota
• https://github.com/hyperium/hyper/commit/01160abd92956e5f995cc45790df7a2b86c8989f · Nota
• https://github.com/hyperium/hyper/blob/master/CHANGELOG.md#v094-2016-05-09 · Nota
• https://rustsec.org/advisories/RUSTSEC-2016-0002.html · Nota
• https://osv.dev/vulnerability/GHSA-9xjr-m6f3-v5wm · Aviso do Fabricante
• https://crates.io/crates/hyper · Nota
• https://t.me/cvenotify/8257 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2016-10932 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10932 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2016-0002 · Aviso do Fabricante