diff --git a/crates/nats/RUSTSEC-2023-0029.md b/crates/nats/RUSTSEC-2023-0029.md index 81eb059e0..5f309eab2 100644 --- a/crates/nats/RUSTSEC-2023-0029.md +++ b/crates/nats/RUSTSEC-2023-0029.md @@ -8,7 +8,7 @@ keywords = ["tls", "mitm"] aliases = ["GHSA-wvc4-j7g5-4f79"] [versions] -patched = [] +patched = [">=0.24.1"] unaffected = ["< 0.9.0"] ``` @@ -16,10 +16,6 @@ unaffected = ["< 0.9.0"] The NATS official Rust clients are vulnerable to MitM when using TLS. -A fix for the `nats` crate hasn't been released yet. Since the `nats` crate -is going to be deprecated anyway, consider switching to `async-nats` `>= 0.29` -which already fixed this vulnerability. - The common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with