CVE-2018-16395: Critical severity ruby-lang Openssl Ruby vulnerability
An instance of OpenSSL::X509::Name contains entities such as CN, C and so on. Some two instances of OpenSSL::X509::Name are equal only when all entities are exactly equal. However, there is a bug that the equality check is not correct if the value of an entity of the argument (right-hand side) starts with the value of the receiver (left-hand side). So, if a malicious X.509 certificate is passed to compare with an existing certificate, there is a possibility to be judged incorrectly that they are equal.
External References:
https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/
Other sources
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
— Launchpad
An issue was discovered in the OpenSSL library in Ruby when two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-16395?
CVE-2018-16395 is a vulnerability in the OpenSSL library in Ruby that allows non-equal objects to return true when compared using certain conditions.
What is the severity of CVE-2018-16395?
CVE-2018-16395 has a severity rating of 9.8, which is considered critical.
Which software versions are affected by CVE-2018-16395?
CVE-2018-16395 affects Ruby versions before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3.
How can I fix CVE-2018-16395?
To fix CVE-2018-16395, update your Ruby installation to version 2.3.8 or later.
Where can I find more information about CVE-2018-16395?
You can find more information about CVE-2018-16395 in the references provided: [Debian LTS announce](https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html), [HackerOne report](https://hackerone.com/reports/387250), [Ruby-lang.org news](https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/).