A flaw was discovered in a way various ruby net:: modules verify commonName (CN) attribute of SSL certificate provided by server against requested hostname, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed site.

Issue was originally reported for net::http(s) module and was assigned CVE id CVE-2007-5162. However, similar issue also affects other modules: net::ftptls, net::telnets, net::imap and CVS versions of net::pop and net::smtp.

Upstream SVN commit: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5162 to the following vulnerability:

The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

References:

http://www.isecpartners.com/advisories/2007-006-rubyssl.txt http://www.securityfocus.com/bid/25847 http://www.securityfocus.com/archive/1/480987

Patch applied to trunk:

http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13499 (original advisory links to other commits in other svn branches)

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.