CVE-2007-5162

Ruby 1.8.5-1.8.6 - Improper Certificate Validation in Net::HTTP and Net::HTTPS

Title source: llm
STIX 2.1

Description

The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

References (35)

Core 35
Core References
Patch vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/25847
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/483577/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27576
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/26985
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2007/3340
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-596-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/36861
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=313791
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27044
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0961.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2007-0965.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27756
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1412
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27673
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10738
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1410
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27769
Vendor Advisory vendor-advisory x_refsource_suse
http://www.novell.com/linux/security/advisories/2007_24_sr.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2008:029
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/29556
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27818
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27432
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/480987/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/3180
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/28645
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2007/dsa-1411
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/27764

Scores

EPSS 0.0168
EPSS Percentile 74.1%

Details

CWE
CWE-287
Status published
Products (2)
ruby-lang/ruby 1.8.5
ruby-lang/ruby 1.8.6
Published Oct 01, 2007
Tracked Since Feb 18, 2026