hackneyでプライベートCAの固定が破られる脆弱性、修正版あり
Summary
Erlang・Elixir向けHTTPクライアントのhackneyに、プライベートCAだけを信頼する設定が効かなくなる脆弱性が見つかりました。該当するのは、ssl_optionsでcacertsかcacertfileを指定して社内CAなどに固定している利用です。hackney 4.9.0以降へ更新し、まず自社の依存関係に該当の設定があるかを洗い出してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Erlang・Elixir向けHTTPクライアントのhackneyに、プライベートCAだけを信頼する設定が効かなくなる脆弱性が見つかりました。該当するのは、ssl_optionsでcacertsかcacertfileを指定して社内CAなどに固定している利用です。hackney 4.9.0以降へ更新し、まず自社の依存関係に該当の設定があるかを洗い出してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| benoitc | hackney |
≥ d8a9afcf5c3849904274e2eba1df56c63d1a1a0c, < 915eb5737e9c489d8fc22eec8cdae30e9b027be4 |
915eb5737e9c489d8fc22eec8cdae30e9b027be4 |
| Hex | hackney |
≥ 1.24.0, < 4.9.0 |
4.9.0 |
Original description The description as published by the source.
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.
The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.
This issue affects hackney: from 1.24.0 before 4.9.0.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- package hex.pm
- web github.com
- web cna.erlef.org
- web osv.dev
- web github.com
- web github.com
- web github.com
- web nvd.nist.gov
- web github.com