Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ3cHYtY2o2eC12M2p3

http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

Permalink: https://github.com/advisories/GHSA-6wpv-cj6x-v3jw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTZ3cHYtY2o2eC12M2p3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 6 years ago
Updated: about 1 year ago

CVSS Score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-6wpv-cj6x-v3jw, CVE-2015-1828
References:

• https://nvd.nist.gov/vuln/detail/CVE-2015-1828
• https://github.com/ruby/openssl/issues/8
• https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU
• https://rubysec.com/advisories/http-CVE-2015-1828
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/http/CVE-2015-1828.yml
• https://github.com/advisories/GHSA-6wpv-cj6x-v3jw

Repository: https://github.com/ruby/openssl
Blast Radius: 25.0

Affected Packages