-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the order-dependent initialization in s2n_connection_set_config. The pre-patch code in s2n_connection.c (lines 303-311) used a temporary auth_type check to determine X509 validation needs. If called before setting client_auth_type, it would default to S2N_CERT_AUTH_NONE and skip validation setup. The patched version removes this conditional, forcing proper validation setup regardless of call order. The added test cases in s2n_mutual_auth_test.c explicitly validate this behavior by testing different API order scenarios.
RustRust| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| s2n-tls | rust | < 0.3.0 | 0.3.0 |
KEV Misses 88% of Exploited CVEs- Get the report