CVE-2017-18588: Medium severity opensecurity mobile security framework vulnerability
An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18588?
CVE-2017-18588 is classified as a moderate severity vulnerability due to its potential impact on the security of certificate validation.
How do I fix CVE-2017-18588?
To fix CVE-2017-18588, update the security-framework crate to version 0.1.12 or later, which includes proper hostname verification.
What does CVE-2017-18588 affect?
CVE-2017-18588 affects the security-framework crate for Rust prior to version 0.1.12 by not verifying hostnames against certificates.
What is the main issue with CVE-2017-18588?
The main issue with CVE-2017-18588 is that hostname verification for certificates does not occur when using custom root certificates.
Who is impacted by CVE-2017-18588?
Developers who use the security-framework crate in their Rust applications with custom root certificates are impacted by CVE-2017-18588.