CVE-2015-1855
Medium
Description
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Ruby
PublishedNov 29, 2019
First seenNov 29, 2019
How to fix
Update
- ruby-lang ruby2.1.6, 2.2.2 or later
- ruby-lang trunk50292 or later
- puppet puppet_enterprise3.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang ruby | 2.1.0 ≤ v < 2.1.6, 2.2.0 ≤ v < 2.2.2, 2.0.0 | 2.1.6, 2.2.2 |
| ruby-lang trunk | v < 50292 | 50292 |
| debian debian_linux | 7.0, 8.0, 9.0 | — |
| puppet puppet_agent | 1.0.0 | — |
| puppet puppet_enterprise | 3.0.0 ≤ v < 3.8.0 | 3.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.