Threats tagged 'ghsa-qv5c-vj5j-fg9q'

Apache bRPC versions prior to 1.18.0 perform server certificate chain validation when client TLS peer verification is enabled but do not verify that the certificate matches the expected DNS name or IP address. This allows a network attacker who can intercept or redirect connections and has a certificate issued by a trusted CA for a different name to impersonate the intended TLS endpoint. The issue affects applications using bRPC client Channels connecting over untrusted networks with certificate verification enabled. The vulnerability is addressed by upgrading to version 1.18.0, which adds hostname verification during the TLS handshake.