The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification.
[
{
"signature_version": "v1",
"id": "CVE-2020-13616-70dcf2cc",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "disconnect",
"file": "src/net/http.cpp"
},
"source": "https://github.com/pichi-router/pichi/commit/2916bd53d298e1143081a24974549e4367a22bac",
"digest": {
"function_hash": "137337912029904505901781117209005375242",
"length": 1035.0
}
},
{
"signature_version": "v1",
"id": "CVE-2020-13616-d7abad56",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "src/net/http.cpp"
},
"source": "https://github.com/pichi-router/pichi/commit/2916bd53d298e1143081a24974549e4367a22bac",
"digest": {
"threshold": 0.9,
"line_hashes": [
"69489399679128650160052406761576552415",
"135572112179782736437937821203965452093",
"83883856479767001370306109378004111995",
"307039956862139459933935978175831468720",
"102940385700334214018001557192047724272",
"207874256715498514481486752652131921339",
"49908123410616073796639104710647880963"
]
}
}
]