Описание
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
The Ruby http gem before 0.6.4 and 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-1828
- https://github.com/ruby/openssl/issues/8
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/http/CVE-2015-1828.yml
- https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU
- https://my.diffend.io/gems/http/0.6.3/0.6.4
- https://my.diffend.io/gems/http/0.7.2/0.7.3
- https://rubysec.com/advisories/http-CVE-2015-1828
Пакеты
Наименование
http
rubygems
Затронутые версииВерсия исправления
>= 0.7.0, < 0.7.3
0.7.3
Наименование
http
rubygems
Затронутые версииВерсия исправления
< 0.6.4
0.6.4
Связанные уязвимости
CVSS3: 5.9
ubuntu
почти 9 лет назад
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
CVSS3: 5.9
nvd
почти 9 лет назад
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
CVSS3: 5.9
debian
почти 9 лет назад
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connec ...