PT-2007-6255 · Ruby+1 · Ruby+1
Tomas Hoger
·
Publicado
2007-10-01
·
Atualizado
2018-10-15
·
CVE-2007-5162
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Ruby versions 1.8.5 through 1.8.6
Description
The issue concerns the connect method in the Net::HTTP and Net::HTTPS libraries, which fails to verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request. This oversight makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
Recommendations
For Ruby versions 1.8.5 through 1.8.6, consider updating to a version that includes a fix for this issue, as the current versions do not properly verify server certificates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Improper Authentication
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Ruby