{"id":"CVE-2017-18588","aliases":["EUVD-2021-1782","GHSA-jqqr-c2r2-9cvr","RUSTSEC-2017-0003"],"status":"published","title":"Improper Certificate Validation in security-framework","description":"An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00654,"percentile":0.51608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2017-03-15T12:00:00Z","modified":"2026-10-24T10:30:32Z","fixes":[{"ecosystem":"crates.io","package":"security-framework","fixed_in":["0.1.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"security-framework","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.12"}]}]},{"source":"osv","ecosystem":"crates.io","package":"security-framework","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.12"}]}]},{"source":"osv","ecosystem":"crates.io","package":"security-framework","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.1.12"}]}]}],"products":[{"vendor":"security-framework_project","product":"security-framework"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2017-0003.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18588","tags":["advisory"]},{"url":"https://github.com/sfackler/rust-security-framework/pull/27","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jqqr-c2r2-9cvr"},{"url":"https://github.com/sfackler/rust-security-framework","tags":["package"]},{"url":"https://crates.io/crates/security-framework","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-18588","description":"An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.","status":"published","published":"2019-08-26T17:18:39Z","modified":"2024-08-05T21:28:55.569Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2021-1782","description":"An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.","status":"published","published":"2019-08-26T17:18:39Z","modified":"2024-08-05T21:28:55Z","updated_at":"2026-11-03T02:23:05.586343Z"}],"ghsa":[{"id":"GHSA-jqqr-c2r2-9cvr","title":"Improper Certificate Validation in security-framework","description":"If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.","status":"published","published":"2021-08-25T20:42:59Z","modified":"2023-06-13T20:37:17Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:36:54.225318Z"}],"nvd":[{"id":"CVE-2017-18588","description":"An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.","status":"published","published":"2019-08-26T18:15:11.217Z","modified":"2026-06-17T01:13:09.043Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:04:20.074898Z"}],"osv":[{"id":"CVE-2017-18588","description":"An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.","status":"published","published":"2019-08-26T18:15:11.217Z","modified":"2026-10-24T10:30:32.504363298Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"GHSA-jqqr-c2r2-9cvr","title":"Improper Certificate Validation in security-framework","description":"If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate. This issue was fixed by properly configuring the trust evaluation logic to perform that check.","status":"published","published":"2021-08-25T20:42:59Z","modified":"2023-11-08T03:59:16.345668Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"RUSTSEC-2017-0003","title":"Hostname verification skipped when custom root certs used","description":"If custom root certificates were registered with a `ClientBuilder`, the\nhostname of the target server would not be validated against its presented leaf\ncertificate.\n\nThis issue was fixed by properly configuring the trust evaluation logic to\nperform that check.","status":"published","published":"2017-03-15T12:00:00Z","modified":"2023-11-08T03:59:16.345668Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}