FreeBSDD4379F59-3E9B-49EB-933B-61DE4D0B0FDBRuby -- OpenSSL Hostname Verification Vulnerability
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
0.028 Low
EPSS
Percentile
90.7%
Ruby Developers report:
After reviewing RFC 6125 and RFC 5280, we found multiple violations
of matching hostnames and particularly wildcard certificates.
Ruby’s OpenSSL extension will now provide a string-based matching
algorithm which follows more strict behavior, as recommended by
these RFCs. In particular, matching of more than one wildcard per
subject/SAN is no-longer allowed. As well, comparison of these
values are now case-insensitive.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| FreeBSD | any | noarch | ruby | = 2.0,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby | < 2.0.0.645,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby20 | = 2.0,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby20 | < 2.0.0.645,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby | = 2.1,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby | < 2.1.6,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby21 | = 2.1,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby21 | < 2.1.6,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby | = 2.2,1 | UNKNOWN |
| FreeBSD | any | noarch | ruby | < 2.2.2,1 | UNKNOWN |
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
0.028 Low
EPSS
Percentile
90.7%