Threats tagged 'ghsa-g7gg-9jhv-68h6'

An improper certificate validation vulnerability in hackney_ssl within the benoitc hackney HTTP client library allows an on-path attacker to impersonate a server pinned to a private certificate authority. The flaw arises because hackney_ssl's partial_chain callback trusts any certificate chain ending in a publicly trusted root, even when a private CA is pinned. Hostname verification still applies, so the attacker must have a publicly trusted certificate for the target hostname. This affects hackney versions from 1.24.0 up to but not including 4.9.0.