CVE-2015-1855

MEDIUM5.9

verify_certificate_identity in the OpenSSL extension in Ruby before 2

Published Nov 29, 2019

Modified 1 years ago

Details

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

References

WEB

http://www.debian.org/security/2015/dsa-3245

WEB

http://www.debian.org/security/2015/dsa-3246

WEB

http://www.debian.org/security/2015/dsa-3247

WEB

https://bugs.ruby-lang.org/issues/9644

WEB

https://puppetlabs.com/security/cve/cve-2015-1855

ADVISORY