Lucene search

K
rustsecRustsecRUSTSEC-2016-0002
HistoryMay 09, 2016 - 12:00 p.m.

HTTPS MitM vulnerability due to lack of hostname verification

2016-05-0912:00:00
rustsec.org
9

0.001 Low

EPSS

Percentile

28.7%

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not
perform hostname verification when making HTTPS requests.

This allows an attacker to perform MitM attacks by preventing any valid
CA-issued certificate, even if there’s a hostname mismatch.

The problem was addressed by leveraging rust-openssl’s built-in support for
hostname verification.

CPENameOperatorVersion
hyperlt0.9.4

0.001 Low

EPSS

Percentile

28.7%

Related for RUSTSEC-2016-0002