rustls webpki Name Constraints URI Validation Bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.103.12, 0.104.0-alpha.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issued certificates, the flaw is only reachable after successful signature verification and requires a misissued certificate to exploit; the library also provides no API for asserting URI names, and URI name constraints are otherwise unimplemented. Versions 0.103.12 and 0.104.0-alpha.6 reject URI name constraints unconditionally.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- rustls webpki
From 0.101.0 · fixed in 0.103.12; From 0.104.0-alpha.1 · fixed in 0.104.0-alpha.6
- rustls-webpkicrates.io
From 0.101.0 · fixed in 0.103.12
- rustls-webpkicrates.io
From 0.104.0-alpha.1 · fixed in 0.104.0-alpha.6
- rustls-webpkicrates.io
From 0.0.0-0 · fixed in 0.103.12; From 0.104.0-alpha.1 · fixed in 0.104.0-alpha.6