CVE-2016-10932 HTTPS MitM vulnerability due to lack of hostname verification
Attackers can perform man-in-the-middle attacks on HTTPS connections due to missing hostname verification in the hyper crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10932?
CVE-2016-10932 is a medium-severity vulnerability in n/a, published on 26 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.
Weakness: CWE-254
Which versions are affected by CVE-2016-10932?
3 open source packages ship an affected version, including hyper. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hyper crates.io | All versions | 0.9.4 |
hyper crates.io | All versions | 0.9.4 |
hyper crates.io | From 0.0.0-0 | 0.9.4 |
Products include Hyper Hyper.
How do I fix CVE-2016-10932?
Upgrade hyper to 0.9.4 or later.
Is CVE-2016-10932 being exploited?
There is no known exploitation of CVE-2016-10932 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-35863 HTTP Request Smuggling in hyper
- CVE-2022-31394 Denial of service in n/a
- CVE-2021-32714 Integer Overflow in Chunked Transfer-Encoding
- CVE-2017-18587 Headers containing newline characters can split messages in hyper
- CVE-2021-21299 Multiple Transfer-Encoding headers misinterprets request payload
Sources
Also known as GHSA-9xjr-m6f3-v5wm, RUSTSEC-2016-0002.