CVE-2013-4073 The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in...
MediumCVSS 6.8
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 1.8.6-26 | No fix listed |
| ruby-lang ruby | = 1.8.7 | No fix listed |
| ruby-lang ruby | = 1.8.7-p160 | No fix listed |
| ruby-lang ruby | = 1.8.7-p17 | No fix listed |
| ruby-lang ruby | = 1.8.7-p173 | No fix listed |
| ruby-lang ruby | = 1.8.7-p174 | No fix listed |
| ruby-lang ruby | = 1.8.7-p22 | No fix listed |
| ruby-lang ruby | = 1.8.7-p248 | No fix listed |
| ruby-lang ruby | = 1.8.7-p249 | No fix listed |
| ruby-lang ruby | = 1.8.7-p299 | No fix listed |
| ruby-lang ruby | = 1.8.7-p301 | No fix listed |
| ruby-lang ruby | = 1.8.7-p302 | No fix listed |
| ruby-lang ruby | = 1.8.7-p330 | No fix listed |
| ruby-lang ruby | = 1.8.7-p334 | No fix listed |
| ruby-lang ruby | = 1.8.7-p352 | No fix listed |
| ruby-lang ruby | = 1.8.7-p357 | No fix listed |
| ruby-lang ruby | = 1.8.7-p358 | No fix listed |
| ruby-lang ruby | = 1.8.7-p370 | No fix listed |
| ruby-lang ruby | = 1.8.7-p371 | No fix listed |
| ruby-lang ruby | = 1.8.7-p373 | No fix listed |
| ruby-lang ruby | = 1.8.7-p71 | No fix listed |
| ruby-lang ruby | = 1.8.7-p72 | No fix listed |
| ruby-lang ruby | = 1.8.7-preview1 | No fix listed |
| ruby-lang ruby | = 1.8.7-preview2 | No fix listed |
| ruby-lang ruby | = 1.8.7-preview3 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | = 1.8.7-preview4 | No fix listed |
| ruby-lang ruby | = 1.9.3 | No fix listed |
| ruby-lang ruby | = 1.9.3-p0 | No fix listed |
| ruby-lang ruby | = 1.9.3-p125 | No fix listed |
| ruby-lang ruby | = 1.9.3-p194 | No fix listed |
| ruby-lang ruby | = 1.9.3-p286 | No fix listed |
| ruby-lang ruby | = 1.9.3-p383 | No fix listed |
| ruby-lang ruby | = 1.9.3-p385 | No fix listed |
| ruby-lang ruby | = 1.9.3-p392 | No fix listed |
| ruby-lang ruby | = 1.9.3-p426 | No fix listed |
| ruby-lang ruby | = 1.9.3-p429 | No fix listed |
| ruby-lang ruby | = 2.0.0-p0 | No fix listed |
| ruby-lang ruby | = 2.0.0-p195 | No fix listed |
| ruby-lang ruby | = 2.0.0-preview1 | No fix listed |
| ruby-lang ruby | = 2.0.0-preview2 | No fix listed |
| ruby-lang ruby | = 2.0.0-rc1 | No fix listed |
| ruby-lang ruby | = 2.0.0-rc2 | No fix listed |
References
- forums.interworx.com
- APPLE-SA-2013-10-22-3 vendor-advisory
- openSUSE-SU-2013:1181 vendor-advisory
- openSUSE-SU-2013:1186 vendor-advisory
- RHSA-2013:1090 vendor-advisory
- RHSA-2013:1103 vendor-advisory
- RHSA-2013:1137 vendor-advisory
- support.apple.com
- DSA-2738 vendor-advisory
- DSA-2809 vendor-advisory
- www.ruby-lang.org vendor-advisory
- USN-1902-1 vendor-advisory
- bugzilla.redhat.com
- puppet.com