CVE-2009-0642

2009-02-2000:00:00

ubuntu.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

0.021

Percentile

89.3%

JSON

ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the
return value from the OCSP_basic_verify function, which might allow remote
attackers to successfully present an invalid X.509 certificate, possibly
involving a revoked certificate.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchruby1.8< 1.8.4-1ubuntu1.7UNKNOWN
ubuntu8.04noarchruby1.8< 1.8.6.111-2ubuntu1.3UNKNOWN
ubuntu8.10noarchruby1.8< 1.8.7.72-1ubuntu0.2UNKNOWN
ubuntu9.04noarchruby1.8< 1.8.7.72-3ubuntu0.1UNKNOWN
ubuntu8.10noarchruby1.9< 1.9.0.2-7ubuntu1.2UNKNOWN
ubuntu9.04noarchruby1.9< 1.9.0.2-9ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	ruby1.8	< 1.8.4-1ubuntu1.7	UNKNOWN
ubuntu	8.04	noarch	ruby1.8	< 1.8.6.111-2ubuntu1.3	UNKNOWN
ubuntu	8.10	noarch	ruby1.8	< 1.8.7.72-1ubuntu0.2	UNKNOWN
ubuntu	9.04	noarch	ruby1.8	< 1.8.7.72-3ubuntu0.1	UNKNOWN
ubuntu	8.10	noarch	ruby1.9	< 1.9.0.2-7ubuntu1.2	UNKNOWN
ubuntu	9.04	noarch	ruby1.9	< 1.9.0.2-9ubuntu1.1	UNKNOWN