PT-2015-1107 · Openssl+4 · Openssl+4

Jeffrey Walton + 2 · Published 2015-04-09 · Updated 2024-06-15 · CVE-2015-1855

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.0.0 patchlevel 645 Ruby versions 2.1.x prior to 2.1.6 Ruby versions 2.2.x prior to 2.2.2

Description The issue concerns the improper validation of hostnames in the OpenSSL extension in Ruby, allowing remote attackers to spoof servers. This can be achieved through various vectors, including multiple wildcards, wildcards in IDNA names, case sensitivity, and non-ASCII characters. The vulnerability enables an attacker to substitute an SSL server using a specially crafted certificate.

Recommendations For Ruby versions prior to 2.0.0 patchlevel 645, update to a version that includes the necessary patches. For Ruby versions 2.1.x prior to 2.1.6, update to version 2.1.6 or later. For Ruby versions 2.2.x prior to 2.2.2, update to version 2.2.2 or later. As a temporary workaround, consider restricting the use of wildcard certificates in the OpenSSL extension until a patch is applied.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

Related Identifiers

ALT-PU-2016-2061

BDU:2015-09978

CVE-2015-1855

DLA-224-1

DLA-235-1

DSA-3245-1

DSA-3246-1

DSA-3247-1

MGASA-2015-0178

OPENSUSE-SU-2017_1128-1

OPENSUSE-SU-2024:10090-1

OPENSUSE-SU-2024:10481-1

SUSE-SU-2015:1889-1

SUSE-SU-2017:0948-1

SUSE-SU-2017:1067-1

SUSE-SU-2017_0948-1

USN-3365-1

Affected Products

Alt Linux

Openssl

Ruby

Suse

Ubuntu

References · 111

• https://security-tracker.debian.org/tracker/DSA-3245-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3247-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2337 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1855 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16254 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4363 · Security Note
• https://ubuntu.com/security/CVE-2015-1855 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1067-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1855 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5147 · Security Note
• https://security-tracker.debian.org/tracker/source-package/ruby2.1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4466 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-2061 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4522 · Security Note