REDHAT-BUG-362081: Medium severity ruby vulnerability
A flaw was discovered in a way various ruby net:: modules verify commonName (CN) attribute of SSL certificate provided by server against requested hostname, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed site.
Issue was originally reported for net::http(s) module and was assigned CVE id CVE-2007-5162. However, similar issue also affects other modules: net::ftptls, net::telnets, net::imap and CVS versions of net::pop and net::smtp.
Upstream SVN commit: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-362081?
The severity of REDHAT-BUG-362081 is considered high due to the potential for remote attackers to perform man-in-the-middle attacks.
How do I fix REDHAT-BUG-362081?
To fix REDHAT-BUG-362081, upgrade to the latest version of the Ruby language that addresses this vulnerability.
What types of applications are affected by REDHAT-BUG-362081?
Applications utilizing Ruby net::* modules for SSL certificate verification are affected by REDHAT-BUG-362081.
What could happen if REDHAT-BUG-362081 is exploited?
If REDHAT-BUG-362081 is exploited, attackers may intercept sensitive SSL transmissions or redirect users to spoofed websites.
When was REDHAT-BUG-362081 reported?
REDHAT-BUG-362081 was reported in 2007, highlighting a critical flaw in SSL certificate handling in Ruby.