Rust advisories / security-framework
Vulnerability MediumRUSTSEC-2017-0003 · security-framework
RUSTSEC-2017-0003: Hostname verification skipped when custom root certs used
Short answerA security vulnerability in the security-framework crate: Hostname verification skipped when custom root certs used. Medium severity (CVSS 5.3). Fixed in 0.1.12: update to a fixed version.
| Crate | security-framework |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.1.12. |
| Fixed in | 0.1.12 |
| Severity | Medium, CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| Published | 2017-03-15 |
| Last changed | 2023-11-08 |
| Also known as | CVE-2017-18588, GHSA-jqqr-c2r2-9cvr |
What to do
- See which version you have:
cargo tree -i security-framework(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p security-framework. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplesecurity-framework = "0.1.12") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
If custom root certificates were registered with a ClientBuilder, the hostname of the target server would not be validated against its presented leaf certificate.
This issue was fixed by properly configuring the trust evaluation logic to perform that check.
References
- Package: crates.io/crates/security-framework
- Advisory: rustsec.org/advisories/RUSTSEC-2017-0003.html
- Web: github.com/sfackler/rust-security-framework/pull/27
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same cratesecurity-framework: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?