CVE-2007-5770: Medium severity ruby-lang Ruby vulnerability
A flaw was discovered in a way various ruby net:: modules verify commonName (CN) attribute of SSL certificate provided by server against requested hostname, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed site.
Issue was originally reported for net::http(s) module and was assigned CVE id CVE-2007-5162. However, similar issue also affects other modules: net::ftptls, net::telnets, net::imap and CVS versions of net::pop and net::smtp.
Upstream SVN commit: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656
Other sources
The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5770?
CVE-2007-5770 has been classified with a moderate severity level, due to its potential for man-in-the-middle attacks.
How do I fix CVE-2007-5770?
To fix CVE-2007-5770, you should upgrade Ruby to a patched version that addresses this vulnerability.
Which versions of Ruby are affected by CVE-2007-5770?
CVE-2007-5770 affects Ruby version 1.8.5 and version 1.8.6 specifically.
What type of attacks does CVE-2007-5770 expose users to?
CVE-2007-5770 exposes users to possible man-in-the-middle attacks and spoofing threats.
Is CVE-2007-5770 related to SSL verification issues?
Yes, CVE-2007-5770 relates to the improper handling of SSL certificate verification in Ruby's net modules.