PT-2017-15155 · Rust · Security-Framework

Published 2017-03-15 · Updated 2021-08-25 · CVE-2017-18588

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions security-framework crate versions prior to 0.1.12

Description An issue was discovered where hostname verification for certificates does not occur if ClientBuilder uses custom root certificates. Specifically, if custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.

Recommendations For security-framework crate versions prior to 0.1.12, update to version 0.1.12 or later to resolve the issue. As a temporary workaround, consider avoiding the use of custom root certificates with ClientBuilder until the update is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-18588

GHSA-JQQR-C2R2-9CVR

RUSTSEC-2017-0003

Affected Products

Security-Framework

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-18588 · Security Note
• https://rustsec.org/advisories/RUSTSEC-2017-0003.html · Patch
• https://osv.dev/vulnerability/GHSA-jqqr-c2r2-9cvr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18588 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2017-0003 · Vendor Advisory
• https://github.com/sfackler/rust-security-framework · Note
• https://github.com/sfackler/rust-security-framework/pull/27 · Note
• https://crates.io/crates/security-framework · Note