Описание
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 1.8.7.358-7ubuntu2 |
| lucid | ignored | end of life |
| precise | released | 1.8.7.352-2ubuntu1.3 |
| quantal | released | 1.8.7.358-4ubuntu0.3 |
| raring | released | 1.8.7.358-7ubuntu1.1 |
| upstream | released | 1.8.7 patchlevel 374 |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 1.9.3.194-8.1ubuntu2 |
| lucid | ignored | end of life |
| precise | released | 1.9.3.0-1ubuntu2.7 |
| quantal | released | 1.9.3.194-1ubuntu1.5 |
| raring | released | 1.9.3.194-8.1ubuntu1.1 |
| upstream | released | 1.9.3 patchlevel 448 |
Показывать по
EPSS
6.8 Medium
CVSS2
Связанные уязвимости
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/s ...
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
EPSS
6.8 Medium
CVSS2