RHSA-2007:0965: Moderate: ruby security update
Ruby is an interpreted scripting language for object-oriented programming.An SSL certificate validation flaw was discovered in several Ruby Netmodules. The libraries were not checking the requested host name againstthe common name (CN) in the SSL server certificate, possibly allowing a manin the middle attack. (CVE-2007-5162, CVE-2007-5770)Users of Ruby should upgrade to these updated packages, which contain abackported patch to resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2007:0965?
The severity of RHSA-2007:0965 is classified as moderate due to the SSL certificate validation flaw.
How do I fix RHSA-2007:0965?
To fix RHSA-2007:0965, update the affected Ruby packages to version 1.8.5-5.el5_1.1.
Which Ruby packages are affected by RHSA-2007:0965?
Affected packages include ruby, ruby-devel, ruby-docs, and several others related to Ruby on Red Hat.
What is the nature of the vulnerability in RHSA-2007:0965?
The vulnerability in RHSA-2007:0965 involves a failure to validate the common name in SSL certificates, potentially allowing man-in-the-middle attacks.
Is there a workaround for RHSA-2007:0965?
There is no documented workaround for RHSA-2007:0965; upgrading the affected packages is the only solution.