Skip to content

CVE-2015-1828 http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

MediumCVSS 5.9 EPSS 1.5% PoC
Published
Updated
Exploit status
Proof-of-concept only
Sign in for asset impact Search another CVE

Description

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

Affected products

ProductAffected versionsFixed in
rubygems http(RubyGems) >= 0.7.0, < 0.7.3 0.7.3
rubygems http(RubyGems) = 0.7.0 No fix listed
rubygems http(RubyGems) = 0.7.1 No fix listed
rubygems http(RubyGems) = 0.7.2 No fix listed
rubygems http(RubyGems) < 0.6.4 0.6.4
rubygems http(RubyGems) = 0.0.0 No fix listed
rubygems http(RubyGems) = 0.0.1 No fix listed
rubygems http(RubyGems) = 0.0.2 No fix listed
rubygems http(RubyGems) = 0.1.0 No fix listed
rubygems http(RubyGems) = 0.2.0 No fix listed
rubygems http(RubyGems) = 0.3.0 No fix listed
rubygems http(RubyGems) = 0.4.0 No fix listed
rubygems http(RubyGems) = 0.5.0 No fix listed
rubygems http(RubyGems) = 0.5.0.pre No fix listed
rubygems http(RubyGems) = 0.5.0.pre2 No fix listed
rubygems http(RubyGems) = 0.5.1 No fix listed
rubygems http(RubyGems) = 0.6.0 No fix listed
rubygems http(RubyGems) = 0.6.0.pre No fix listed
rubygems http(RubyGems) = 0.6.1 No fix listed
rubygems http(RubyGems) = 0.6.2 No fix listed
rubygems http(RubyGems) = 0.6.3 No fix listed
debian/ruby-http(Debian:12) < 1.0.2-2 1.0.2-2
debian/ruby-http(Debian:13) < 1.0.2-2 1.0.2-2
debian/ruby-http(Debian:14) < 1.0.2-2 1.0.2-2
http.rb project http.rb <= 0.7.2 No fix listed

References