CVE-2007-5162: Medium severity ruby-lang Ruby vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5162 to the following vulnerability:
The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
References:
http://www.isecpartners.com/advisories/2007-006-rubyssl.txt http://www.securityfocus.com/bid/25847 http://www.securityfocus.com/archive/1/480987
Patch applied to trunk:
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13499 (original advisory links to other commits in other svn branches)
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2007-5162?
CVE-2007-5162 has a medium severity rating due to its potential to allow remote attackers to intercept SSL transmissions.
How do I fix CVE-2007-5162?
To fix CVE-2007-5162, update Ruby to version 1.8.7 or later, which includes proper certificate validation.
What versions of Ruby are affected by CVE-2007-5162?
CVE-2007-5162 affects Ruby versions 1.8.5 and 1.8.6.
What specific method in Ruby is vulnerable according to CVE-2007-5162?
The connect method in the Net::HTTP and Net::HTTPS libraries is vulnerable according to CVE-2007-5162.
Is CVE-2007-5162 a critical vulnerability?
CVE-2007-5162 is not classified as critical, but it poses security risks that should be addressed promptly.