CVE-2016-10931 - An issue was discovered in the openssl crate before 0.9.0 for Rust

Back Back to CVE browser

HIGH

An issue was discovered in the openssl crate before 0.9.0 for Rust

Published Aug 26, 2019

8.1

HIGH

CVSS 3.0

EPSS 0.74%

Description

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1528
Advisory
https://github.com/advisories/GHSA-34p9-f4q3-c4r7
Advisory
https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0
https://nvd.nist.gov/vuln/detail/CVE-2016-10931
https://rustsec.org/advisories/RUSTSEC-2016-0001.html
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1528		Advisory
https://github.com/advisories/GHSA-34p9-f4q3-c4r7		Advisory
https://github.com/sfackler/rust-openssl/releases/tag/v0.9.0
https://nvd.nist.gov/vuln/detail/CVE-2016-10931
https://rustsec.org/advisories/RUSTSEC-2016-0001.html		x_refsource_MISCRelease NotesVendor Advisory