Vulnerability GHSA-9xjr-m6f3-v5wm
Medium Risk
MEDIUM RISK
CVSS Score: 4.8
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
5 years ago
August 25, 2021 at 08:43 PM UTC
HTTPS MitM vulnerability due to lack of hostname verification
0.0.1 - 0.9.3
0.0.1 - 0.9.3
Summary
HTTPS MitM vulnerability due to lack of hostname verification
Details
When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests.
This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch.
The problem was addressed by leveraging rust-openssl's built-in support for hostname verification.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 GHSA-f67m-9j94-qv9j
Unknown
4 years ago
Parser creates invalid uninitialized value
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
0.0.1 - 0.12.36 and 0.13.0 - 0.14.11 RUSTSEC-2022-0022
Medium Risk
5 years ago
HTTP Request Smuggling in hyper
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
0.12.0 - 0.12.35 and 0.13.0 - 0.13.9 and 0.14.0 - 0.14.2 GHSA-6hfq-h8hq-87mf
Critical
5 years ago
HTTP Request Smuggling in hyper
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
0.11.0 - 0.12.33 GHSA-h3qr-rq2j-74w4
Medium Risk
5 years ago
Headers containing newline characters can split messages in hyper
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1 GHSA-q89x-f52w-6hj2
0.0.1 - 0.9.17 and 0.10.0 - 0.10.1 GHSA-q89x-f52w-6hj2
Impacted packages
Timeline
Published
5 years ago
August 25, 2021 at 08:43 PM UTC
Fixed (0.9.4)
10 years ago
May 09, 2016 at 10:32 PM UTC
Last Modified
2 years ago
November 08, 2023 at 03:58 AM UTC