CVE-2007-5162 The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domai...
MediumCVSS 4.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 1.8.5 | No fix listed |
| ruby-lang ruby | = 1.8.6 | No fix listed |
References
- 26985 third-party-advisory
- 27044 third-party-advisory
- 27432 third-party-advisory
- 27576 third-party-advisory
- 27673 third-party-advisory
- 27756 third-party-advisory
- 27764 third-party-advisory
- 27769 third-party-advisory
- 27818 third-party-advisory
- 28645 third-party-advisory
- 29556 third-party-advisory
- 3180 third-party-advisory
- svn.ruby-lang.org patch
- svn.ruby-lang.org patch
- svn.ruby-lang.org patch
- svn.ruby-lang.org patch
- DSA-1410 vendor-advisory
- DSA-1411 vendor-advisory
- DSA-1412 vendor-advisory
- www.isecpartners.com
- MDVSA-2008:029 vendor-advisory
- SUSE-SR:2007:024 vendor-advisory
- RHSA-2007:0961 vendor-advisory
- RHSA-2007:0965 vendor-advisory
- 20070927 Ruby Net::HTTPS library does not validate server certificate CN mailing-list
- 20071112 FLEA-2007-0068-1 ruby mailing-list
- 25847 patch vdb-entry
- USN-596-1 vendor-advisory
- ADV-2007-3340 vdb-entry
- bugzilla.redhat.com
- ruby-nethttps-mitm(36861) vdb-entry
- oval:org.mitre.oval:def:10738 signature vdb-entry
- FEDORA-2007-718 vendor-advisory
- FEDORA-2007-2406 vendor-advisory
- FEDORA-2007-2685 vendor-advisory