CVE-2017-18588

Name of the Vulnerable Software and Affected Versions security-framework crate versions prior to 0.1.12

Description An issue was discovered where hostname verification for certificates does not occur if ClientBuilder uses custom root certificates. Specifically, if custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.

Recommendations For security-framework crate versions prior to 0.1.12, update to version 0.1.12 or later to resolve the issue. As a temporary workaround, consider avoiding the use of custom root certificates with ClientBuilder until the update is applied.