Description
An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | openssl | < 0.9.0 | 0.9.0 | GHSA-34p9-f4q3-c4r7 |
| crates.io | openssl | >= 0.0.0-0, < 0.9.0 | 0.9.0 | RUSTSEC-2016-0001 |