sfackler/rust-security-framework · Security
Improper Certificate Validation in security-framework
- GHSA ID
- GHSA-jqqr-c2r2-9cvr
- CVE ID
- CVE-2017-18588
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v3
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.
CWEs
- CWE-295 · Improper Certificate Validation