CVE-2013-4073 — Ruby vulnerability

11 documents7 sources
Severity
6.8MEDIUMNVD
CNA5.9
EPSS
2.7%
top 14.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ruby-lang Ruby
Timeline
PublishedAug 18
Latest updateMay 14

Description

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages1 packages

▶NVDruby-lang/ruby4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-3gpq-xx45-4rr9: The OpenSSL::SSL↗2022-05-14
▶
CVEList
CVE-2013-4073: The OpenSSL::SSL↗2013-08-18
▶

📋Vendor Advisories

3
Ubuntu
Ruby vulnerability↗2013-07-09
▶
Red Hat
ruby: hostname check bypassing vulnerability in SSL client↗2013-06-27
▶
Debian
CVE-2013-4073: puppet - The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in R...↗2013
▶

💬Community

5
Bugzilla
CVE-2013-4248 php: hostname check bypassing vulnerability in SSL client↗2013-08-14
▶
Bugzilla
CVE-2013-4238 python: hostname check bypassing vulnerability in SSL module↗2013-08-13
▶
Bugzilla
ruby: CVE-2013-4073 ruby: hostname check bypassing vulnerability in SSL client [fedora-all]↗2013-06-28
▶
Bugzilla
CVE-2013-4073 ruby: hostname check bypassing vulnerability in SSL client↗2013-06-28
▶
Bugzilla
jruby: CVE-2013-4073 ruby: hostname check bypassing vulnerability in SSL client [fedora-all]↗2013-06-28
▶
CVE-2013-4073 — Ruby-lang Ruby vulnerability | cvebase