Vulnerability Description
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ruby-Lang | Ruby | >= 2.1.0, < 2.1.6 |
| Ruby-Lang | Trunk | < 50292 |
| Debian | Debian Linux | 7.0 |
| Puppet | Puppet Agent | 1.0.0 |
| Puppet | Puppet Enterprise | >= 3.0.0, < 3.8.0 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2015/dsa-3245Third Party Advisory
- http://www.debian.org/security/2015/dsa-3246Third Party Advisory
- http://www.debian.org/security/2015/dsa-3247Third Party Advisory
- https://bugs.ruby-lang.org/issues/9644Third Party Advisory
- https://puppetlabs.com/security/cve/cve-2015-1855Third Party Advisory
- https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnVendor Advisory
- http://www.debian.org/security/2015/dsa-3245Third Party Advisory
- http://www.debian.org/security/2015/dsa-3246Third Party Advisory
- http://www.debian.org/security/2015/dsa-3247Third Party Advisory
- https://bugs.ruby-lang.org/issues/9644Third Party Advisory
- https://puppetlabs.com/security/cve/cve-2015-1855Third Party Advisory
- https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnVendor Advisory
FAQ
What is CVE-2015-1855?
CVE-2015-1855 is a vulnerability with a CVSS score of 5.9 (MEDIUM). verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers...
How severe is CVE-2015-1855?
CVE-2015-1855 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-1855?
Check the references section above for vendor advisories and patch information. Affected products include: Ruby-Lang Ruby, Ruby-Lang Trunk, Debian Debian Linux, Puppet Puppet Agent, Puppet Puppet Enterprise.