An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rust-openssl | Rust-openssl_project | * | 0.9.0 (excluding) |
| Rust-openssl | Ubuntu | disco | * |
| Rust-openssl | Ubuntu | trusty | * |