An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 22, 2024 | Nov 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade rubygems-develUpgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-libsUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-psychUpgrade ruby-tcltkUpgrade rubyUpgrade rubygemsUpgrade rubygem-rdocUpgrade rubygem-minitest | Apr 27, 2020 | Nov 16, 2018 |
| Amazon_linux | — | Upgrade ruby24Upgrade ruby23 | Dec 7, 2018 | Oct 17, 2018 |
| Centos_linux | — | Upgrade ruby-irbUpgrade ruby-docUpgrade rubygemsUpgrade ruby-debuginfoUpgrade rubygem-minitestUpgrade ruby-develUpgrade rubygem-rdocUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade ruby-tcltkUpgrade rubygem-jsonUpgrade rubyUpgrade rubygem-psychUpgrade rubygem-rakeUpgrade ruby-libs | Dec 15, 2018 | Oct 17, 2018 |
| Debian | — | Upgrade ruby2.5 | Nov 4, 2018 | Oct 17, 2018 |
| Freebsd | — | Upgrade ruby | Oct 21, 2018 | Oct 20, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | Jul 23, 2019 | Nov 16, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade rubyUpgrade ruby-libsUpgrade ruby-irb | May 7, 2019 | Nov 16, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade ruby-irbUpgrade rubyUpgrade ruby-libs | May 7, 2019 | Nov 16, 2018 |
| Oracle Solaris | — | Upgrade runtime/ruby-23 to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4Upgrade runtime/ruby-23/ruby-tk to version 2.3.8-11.4.6.0.1.1.0 on Solaris 11.4 | Feb 20, 2019 | Nov 16, 2018 |
| Oracle_linux | — | Upgrade rubygem-rakeUpgrade rubygem-bigdecimalUpgrade ruby-docUpgrade rubygems-develUpgrade ruby-tcltkUpgrade rubygem-minitestUpgrade ruby-develUpgrade ruby-irbUpgrade rubygem-io-consoleUpgrade rubygem-jsonUpgrade rubygem-rdocUpgrade rubygemsUpgrade rubygem-psychUpgrade ruby-libsUpgrade ruby | Nov 30, 2018 | Oct 17, 2018 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade ruby-docUpgrade ruby-tcltkUpgrade ruby-develUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubyUpgrade rubygemsNo solution existsUpgrade rubygem-minitestUpgrade rubygem-rdocUpgrade rubygem-io-consoleUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-rakeUpgrade ruby-debuginfoUpgrade ruby-irb | Nov 30, 2018 | Nov 16, 2018 |
| Suse | — | Upgrade ruby2.5-stdlibUpgrade yast2-ruby-bindingsUpgrade ruby2.5-develUpgrade ruby2.1-develUpgrade ruby-bundled-gems-rpmhelperUpgrade ruby2.5-devel-extraUpgrade libruby2_1-2_1Upgrade libruby2_5-2_5Upgrade ruby2.1Upgrade ruby2.1-stdlibUpgrade ruby2.5-doc-riUpgrade ruby2.5-docUpgrade ruby2.5 | Jul 22, 2019 | Oct 17, 2018 |
| Ubuntu | — | Upgrade libruby2.0Upgrade libruby2.5Upgrade ruby2.0Upgrade ruby1.9.3Upgrade ruby1.9.1Upgrade libruby1.9.1Upgrade ruby2.5Upgrade libruby2.3Upgrade ruby2.3 | Nov 13, 2018 | Oct 17, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 16, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub