Aller au contenu
en Se connecter
5.9 Moyenne

CVE-2026-103503 Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and…

Description

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out. cacerts_path (HEX_CACERTS_PATH) is documented as the path to the CA certificate store, used instead of the CA bundle that ships with Hex. Hex.HTTP.SSL.ssl_opts/1 passes the configured store as the cacerts option, but builds the partial_chain callback from the bundled store whether cacerts_path is set or not. Hex.HTTP.SSL.partial_chain/2 accepts a server chain when any certificate in it has the same public key as a bundled CA certificate, so a chain that leads to a bundled CA passes verification although the configured store doesn't contain that CA. Hostname verification still applies. This issue affects hex: from 0.20.2 before 2.5.2.

Produits et versions touchés

Produit Versions touchées Corrigé en
hex Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de hex

Les 10 CVE de hex →
CVE-2026-96596 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm… 5.9 Moyenne CVE-2026-105274 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted… 2.1 Faible CVE-2026-81856 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package… 2.3 Faible CVE-2026-96612 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a… 7.5 Élevée
Suivre cette CVE