Design/Logic Flaw

2013-08-1802:52:00

PRIOn knowledge base

www.prio-n.com

8.9 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.2%

JSON

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a ‘\0’ character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CPENameOperatorVersion
rubyeq1.8.7 p370
rubyeq1.9.3 p426
rubyeq1.8.7 p330
rubyeq1.8.7 p334
rubyeq1.8.7 p248
rubyeq1.8.7 preview3
rubyeq1.8.7 p17
rubyeq1.8.6-26
rubyeq1.9.3 p286
rubyeq1.9.3 p385

Name	Operator	Version
ruby	eq	1.8.7 p370
ruby	eq	1.9.3 p426
ruby	eq	1.8.7 p330
ruby	eq	1.8.7 p334
ruby	eq	1.8.7 p248
ruby	eq	1.8.7 preview3
ruby	eq	1.8.7 p17
ruby	eq	1.8.6-26
ruby	eq	1.9.3 p286
ruby	eq	1.9.3 p385