CVE-2018-16395Improper Certificate Validation in Openssl

Severity
9.8CRITICALNVD
EPSS
4.4%
top 10.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 16
Latest updateMay 13

Description

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leve

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages4 packages

NVDruby-lang/openssl< 2.1.2
RubyGemsopenssl/openssl2.1.02.1.2+1
Alpineruby-lang/ruby< 2.5.2-r0+18
NVDruby-lang/ruby2.3.02.3.7+3

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, 18.10, Enterprise Linux 7.4

Patches

🔴Vulnerability Details

5
GHSA
Ruby Openssl Allows Incorrect Value Comparison2022-05-13
OSV
Ruby Openssl Allows Incorrect Value Comparison2022-05-13
OSV
CVE-2018-16395: An issue was discovered in the OpenSSL library in Ruby before 22018-11-16
CVEList
CVE-2018-16395: An issue was discovered in the OpenSSL library in Ruby before 22018-11-16
OSV
ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities2018-11-05

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security (Ruby) — CVE-2018-163952020-01-15
Microsoft
An issue was discovered in the OpenSSL library in Ruby before 2.3.8 2.4.x before 2.4.5 2.5.x before 2.5.2 and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using == de2018-11-13
Ubuntu
Ruby vulnerabilities2018-11-05
Red Hat
ruby: OpenSSL::X509:: Name equality check does not work correctly2018-10-17

💬Community

2
Bugzilla
CVE-2018-16395 ruby: OpenSSL::X509::Name equality check does not work correctly2018-10-25
Bugzilla
CVE-2018-16395 CVE-2018-16396 ruby: various flaws [fedora-all]2018-10-25
CVE-2018-16395 — Improper Certificate Validation | cvebase