description: Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.
problem types: Improper Validation of Certificate with Host Mismatch (CWE-297)
affected:
{
product: Osquery
vendor: Facebook
versions:
status: affected, version: 4.2.0
lessThan: unspecified, status: affected, version: next of 2.9.0, versionType: custom
status: affected, version: 2.9.0
}