GHSA-f5v5-ccqc-6w36: async-nats vulnerable to TLS certificate common name validation bypass
The NATS official Rust clients are vulnerable to MitM when using TLS.
The common name of the server’s TLS certificate is validated against the host
name provided by the server’s plaintext INFO
message during the initial connection setup phase. A MitM proxy can tamper with the host
field’s value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.
References
Detect and mitigate GHSA-f5v5-ccqc-6w36 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →