GHSA-9xjr-m6f3-v5wm

    Dashboard / Vulnerabilities / GHSA-9xjr-m6f3-v5wm

    GHSA-9xjr-m6f3-v5wm

    Published: 25 Aug 2021Last Modified: 8 Nov 2023

    Summary: HTTPS MitM vulnerability due to lack of hostname verification

    Details: When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by leveraging rust-openssl's built-in support for hostname verification.

    References: https://nvd.nist.gov/vuln/detail/CVE-2016-10932, https://github.com/hyperium/hyper/issues/472, https://github.com/hyperium/hyper/commit/01160abd92956e5f995cc45790df7a2b86c8989f, https://github.com/hyperium/hyper/blob/master/CHANGELOG.md#v094-2016-05-09, https://rustsec.org/advisories/RUSTSEC-2016-0002.html

    Affected packages

    Package

    Name: hyper

    Purl: pkg:cargo/hyper

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.9.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High