github.com
https://github.com/sfackler/rust-openssl CVE-2016-10931
HIGH
Improper Certificate Validation in openssl
Record summary
CVE-2016-10931 has a selected CVSS score of 8.1 (high).
Description
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Description source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
opensslBrowse crates.io / openssl | GitHub Advisory | Before 0.9.0 · Fixed in 0.9.0 | affected |
References
4github.com
https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2016-10931 rustsec.org
https://rustsec.org/advisories/RUSTSEC-2016-0001.html