From 72a4178ca1ea7fb1fc6376b47ea7ea74661be4d3 Mon Sep 17 00:00:00 2001 From: Tony Arcieri Date: Sat, 25 Mar 2017 14:32:37 -0700 Subject: [PATCH] Advisory: openssl <0.9.0 may be vulnerable to MitM due to weak defaults --- crates/openssl/RUSTSEC-0000-0000.toml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 crates/openssl/RUSTSEC-0000-0000.toml diff --git a/crates/openssl/RUSTSEC-0000-0000.toml b/crates/openssl/RUSTSEC-0000-0000.toml new file mode 100644 index 0000000..75a097c --- /dev/null +++ b/crates/openssl/RUSTSEC-0000-0000.toml @@ -0,0 +1,20 @@ +[advisory] +id = "RUSTSEC-0000-0000" +package = "openssl" +patched_versions = [">= 0.9.0"] +date = "2016-11-05" +url = "https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0" +title = "SSL/TLS MitM vulnerability due to insecure defaults" +description = """ +All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults +including off-by-default certificate verification and no API to perform hostname +verification. + +Unless configured correctly by a developer, these defaults could allow an attacker +to perform man-in-the-middle attacks. + +The problem was addressed in newer versions by enabling certificate verification +by default and exposing APIs to perform hostname verification. Use the +`SslConnector` and `SslAcceptor` types to take advantage of these new features +(as opposed to the lower-level `SslContext` type). +"""