PT-2016-4588 · Rust · Hyper

Published 2016-05-09 · Updated 2021-08-25 · CVE-2016-10932

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions hyper crate versions prior to 0.9.4

Description An issue was discovered in the hyper crate for Rust on Windows, allowing an HTTPS man-in-the-middle attack because hostname verification was omitted. This enables an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch.

Recommendations For versions prior to 0.9.4, update to version 0.9.4 or later to address the issue by leveraging rust-openssl's built-in support for hostname verification.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-254

CWE-347

Related Identifiers

CVE-2016-10932

GHSA-9XJR-M6F3-V5WM

RUSTSEC-2016-0002

Affected Products

Hyper

References · 10

• https://osv.dev/vulnerability/GHSA-9xjr-m6f3-v5wm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10932 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10932 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2016-0002 · Vendor Advisory
• https://github.com/hyperium/hyper/issues/472 · Note
• https://github.com/hyperium/hyper/commit/01160abd92956e5f995cc45790df7a2b86c8989f · Note
• https://github.com/hyperium/hyper/blob/master/CHANGELOG.md#v094-2016-05-09 · Note
• https://rustsec.org/advisories/RUSTSEC-2016-0002.html · Note
• https://crates.io/crates/hyper · Note
• https://t.me/cvenotify/8257 · Telegram Post