PT-2023-9883 · Ruby · Jruby-Openssl

Nahi + 1 · Publicado 2023-01-19 · Atualizado 2023-12-14 · CVE-2009-4123

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions jruby-openssl gem versions prior to 0.6

Description A security issue was found in the handling of SSL certificate validation, where failed verification did not properly alert the application, making it vulnerable to attacks. This could allow attackers to make a client believe a connection to a rogue SSL server is legitimate or to penetrate client-validated SSL server applications using a dummy certificate.

Recommendations For versions prior to 0.6, update the jruby-openssl gem to version 0.6 or later to resolve the issue. As a temporary workaround, consider disabling SSL connections until the update is applied. Restrict access to sensitive applications using the jruby-openssl gem to minimize the risk of exploitation.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2009-4123

GHSA-XGV7-PQQH-H2W9

Produtos afetados

Jruby-Openssl

Referências · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jruby-openssl/CVE-2009-4123.yml · Exploit
• https://github.com/jruby/jruby-openssl · Nota
• https://github.com/advisories/GHSA-xgv7-pqqh-h2w9 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-xgv7-pqqh-h2w9 · Aviso do Fabricante
• https://web.archive.org/web/20101213091125/http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4123 · Nota de Segurança
• http://jruby.org/2009/12/07/vulnerability-in-jruby-openssl · Nota