Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2015-1855

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

  • Published: Nov 29, 2019
  • Updated: Apr 13, 2023
  • CVE: CVE-2015-1855
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.9
  • AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

Software From Fixed in
ruby-lang / ruby 2.0.0-p481 2.0.0-p481.x
ruby-lang / ruby 2.0.0-p353 2.0.0-p353.x
ruby-lang / ruby 2.0.0-p195 2.0.0-p195.x
ruby-lang / ruby 2.0.0-p643 2.0.0-p643.x
ruby-lang / ruby 2.0.0-p594 2.0.0-p594.x
ruby-lang / ruby 2.0.0-p598 2.0.0-p598.x
ruby-lang / ruby 2.0.0-p247 2.0.0-p247.x
ruby-lang / ruby 2.0.0-p0 2.0.0-p0.x
ruby-lang / ruby 2.0.0-p451 2.0.0-p451.x
ruby-lang / ruby 2.0.0-p576 2.0.0-p576.x
ruby-lang / trunk - 50292
ruby-lang / ruby 2.0.0 2.0.0.x
ruby-lang / ruby 2.1.0 2.1.6
ruby-lang / ruby 2.2.0 2.2.2
debian / debian_linux 8.0 8.0.x
debian / debian_linux 7.0 7.0.x
debian / debian_linux 9.0 9.0.x
puppet / puppet_enterprise 3.0.0 3.8.0
puppet / puppet_agent 1.0.0 1.0.0.x