PT-2016-4587 · Openssl · Rust-Openssl

Published 2016-11-05 · Updated 2023-02-27 · CVE-2016-10931

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rust-openssl versions prior to 0.9.0

Description The issue is related to SSL/TLS man-in-the-middle attacks due to insecure defaults in the openssl crate for Rust. Specifically, certificate verification is off by default, and there is no API for hostname verification. This could allow an attacker to perform man-in-the-middle attacks unless the developer configures the settings correctly. The problem was addressed in newer versions by enabling certificate verification by default and exposing APIs to perform hostname verification.

Recommendations For versions prior to 0.9.0, update to version 0.9.0 or later to enable certificate verification by default and expose APIs for hostname verification. Use the SslConnector and SslAcceptor types instead of the lower-level SslContext type to take advantage of the new features.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-10931

GHSA-34P9-F4Q3-C4R7

RUSTSEC-2016-0001

Affected Products

Rust-Openssl

References · 8

• https://osv.dev/vulnerability/GHSA-34p9-f4q3-c4r7 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2016-0001 · Vendor Advisory
• https://rustsec.org/advisories/RUSTSEC-2016-0001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10931 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10931 · Vendor Advisory
• https://github.com/sfackler/rust-openssl · Note
• https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0 · Note
• https://crates.io/crates/openssl · Note