V言語net.httpがHTTPS証明書を検証しない脆弱性、修正あり
Summary
V言語の標準ライブラリnet.httpは、既定でサーバー証明書を検証せず、通信経路上の第三者にHTTPS通信を盗み見られ、書き換えられるおそれがあります。Vで書いたツールを運用する組織は、修正を含むVで再ビルドし、validateの設定も確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
V言語の標準ライブラリnet.httpは、既定でサーバー証明書を検証せず、通信経路上の第三者にHTTPS通信を盗み見られ、書き換えられるおそれがあります。Vで書いたツールを運用する組織は、修正を含むVで再ビルドし、validateの設定も確認してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| vlangv |
≤ 0.5.2→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web github.com
- web github.com
- web vulncheck.com
- web nvd.nist.gov
- web github.com