REDHAT-BUG-362081
First published: Thu Nov 01 2007(Updated: )
A flaw was discovered in a way various ruby net::* modules verify commonName (CN) attribute of SSL certificate provided by server against requested hostname, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed site. Issue was originally reported for net::http(s) module and was assigned CVE id <a href="https://access.redhat.com/security/cve/CVE-2007-5162">CVE-2007-5162</a>. However, similar issue also affects other modules: net::ftptls, net::telnets, net::imap and CVS versions of net::pop and net::smtp. Upstream SVN commit: <a href="http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656">http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2007-5162
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656
- http://rhn.redhat.com/errata/RHSA-2007-0965.html
- http://rhn.redhat.com/errata/RHSA-2007-0961.html
- https://admin.fedoraproject.org/updates/F7/FEDORA-2007-2685
- https://admin.fedoraproject.org/updates/F8/FEDORA-2007-2812
- https://bugzilla.redhat.com/show_bug.cgi?id=362081
Frequently Asked Questions
What is the severity of REDHAT-BUG-362081?
The severity of REDHAT-BUG-362081 is considered high due to the potential for remote attackers to perform man-in-the-middle attacks.
How do I fix REDHAT-BUG-362081?
To fix REDHAT-BUG-362081, upgrade to the latest version of the Ruby language that addresses this vulnerability.
What types of applications are affected by REDHAT-BUG-362081?
Applications utilizing Ruby net::* modules for SSL certificate verification are affected by REDHAT-BUG-362081.
What could happen if REDHAT-BUG-362081 is exploited?
If REDHAT-BUG-362081 is exploited, attackers may intercept sensitive SSL transmissions or redirect users to spoofed websites.
When was REDHAT-BUG-362081 reported?
REDHAT-BUG-362081 was reported in 2007, highlighting a critical flaw in SSL certificate handling in Ruby.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2007-5770
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ruby
- canonical/ruby