CVE-2015-1855

原文の説明

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

影響を受けるソフトウェア

• Ruby ≥ 2.1.0 < 2.1.6≥ 2.2.0 < 2.2.2= 2.0.0 修正バージョン: 2.1.6, 2.2.2 完全一致

詳細

公開日

2019-11-30

最終更新

2024-08-06

CVSS ベクター

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

参考資料

• cve.org/CVE-2015-1855
• nvd.nist.gov/vuln/detail/CVE-2015-1855
• www.debian.org/security/2015/dsa-3247
• www.debian.org/security/2015/dsa-3245
• www.debian.org/security/2015/dsa-3246
• www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/
• puppetlabs.com/security/cve/cve-2015-1855
• bugs.ruby-lang.org/issues/9644