-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how TLS certificate validation was implemented in the connection setup process. The commit diff shows a critical change in connector.rs where the domain name for certificate validation was previously derived from the server-provided INFO message's 'host' field (info.host) but was later changed to use the original tls_host parameter. The vulnerable code path in versions <0.29.0 trusted the attacker-controllable INFO.host value for TLS CN validation, while the patched version uses the client's intended hostname (tls_host). This matches the vulnerability description of trusting a tamperable plaintext field for security-critical certificate validation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| async-nats | rust | < 0.29.0 | 0.29.0 |