PT-2017-15155 · Rust · Security-Framework

Publicado 2017-03-15 · Atualizado 2021-08-25 · CVE-2017-18588

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions security-framework crate versions prior to 0.1.12

Description An issue was discovered where hostname verification for certificates does not occur if ClientBuilder uses custom root certificates. Specifically, if custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.

Recommendations For security-framework crate versions prior to 0.1.12, update to version 0.1.12 or later to resolve the issue. As a temporary workaround, consider avoiding the use of custom root certificates with ClientBuilder until the update is applied.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-18588

GHSA-JQQR-C2R2-9CVR

RUSTSEC-2017-0003

Produtos afetados

Security-Framework

Referências · 8

• https://github.com/sfackler/rust-security-framework · Nota
• https://github.com/sfackler/rust-security-framework/pull/27 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-18588 · Nota de Segurança
• https://rustsec.org/advisories/RUSTSEC-2017-0003.html · Correção
• https://crates.io/crates/security-framework · Nota
• https://osv.dev/vulnerability/GHSA-jqqr-c2r2-9cvr · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-18588 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2017-0003 · Aviso do Fabricante