CVE-2007-5770 The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the...
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 1.8.5 | No fix listed |
| ruby-lang ruby | = 1.8.6 | No fix listed |
References
- docs.info.apple.com
- APPLE-SA-2007-12-17 vendor-advisory
- 26985 third-party-advisory vendor-advisory
- 27576 third-party-advisory vendor-advisory
- 27673 patch third-party-advisory vendor-advisory
- 27756 third-party-advisory
- 27764 third-party-advisory
- 27769 third-party-advisory
- 27818 third-party-advisory
- 28136 third-party-advisory
- 28645 third-party-advisory
- 29556 third-party-advisory
- svn.ruby-lang.org
- DSA-1410 vendor-advisory
- DSA-1411 vendor-advisory
- DSA-1412 vendor-advisory
- MDVSA-2008:029 vendor-advisory
- SUSE-SR:2007:024 vendor-advisory
- RHSA-2007:0961 vendor-advisory
- RHSA-2007:0965 patch vendor-advisory
- 26421 vdb-entry
- 1018938 vdb-entry
- USN-596-1 vendor-advisory
- TA07-352A third-party-advisory us-government-resource
- ADV-2007-4238 vdb-entry
- bugzilla.redhat.com
- oval:org.mitre.oval:def:11025 signature vdb-entry