CVE-2016-10932 — Improper Verification of Cryptographic Signature in Hyper

CWE-254CWE-347 — Improper Verification of Cryptographic Signature6 documents5 sources
Severity
4.8MEDIUMNVD
EPSS
0.2%
top 57.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
HyperDebian Rust-hyper
Timeline
PublishedAug 26
Latest updateAug 25

Description

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 2.2 | Impact: 2.5

Affected Packages3 packages

▶NVDhyper/hyper< 0.9.4
▶crates.iohyper/hyper0.0.0-0 — 0.9.4+1

🔴Vulnerability Details

3
GHSA
HTTPS MitM vulnerability due to lack of hostname verification↗2021-08-25
▶
OSV
HTTPS MitM vulnerability due to lack of hostname verification↗2021-08-25
▶
OSV
HTTPS MitM vulnerability due to lack of hostname verification↗2016-05-09
▶

💥Exploits & PoCs

1
Exploit-DB
School Registration and Fee System - Authentication Bypass↗2016-11-01
▶

📋Vendor Advisories

1
Debian
CVE-2016-10932: rust-hyper - An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. The...↗2016
▶
CVE-2016-10932 — Hyper vulnerability | cvebase