Skip to content

spiffe-rustls v0.6.1

Choose a tag to compare

View all tags
@maxlambrecht maxlambrecht released this 11 May 15:18
· 77 commits to main since this release
spiffe-rustls-0.6.1
bc74566
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release for outbound TLS server certificate verification hardening.

Fixed

  • Outbound TLS server certificate verification: Removed logic that treated rustls NotValidForName and NotValidForNameContext errors from WebPkiServerVerifier as successful verification after combined chain-and-name validation. That behavior assumed path validation had already succeeded whenever rustls reported a TLS name mismatch, which is not a safe invariant. In some cases, it could allow a handshake to succeed without a validated trust path. Path validation is now performed explicitly with verify_server_cert_signed_by_trust_anchor before SPIFFE ID authorization (#346).
Assets 2
Loading