CVE-2015-1855

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

CVSS v3.1

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

2.81% chance of exploitation in the next 30 days, 86th percentile

Published

2019-11-29

Updated

2024-08-06

Proof-of-concept exploits (1)

• vpereira/CVE-2015-18550★ · 2017-03-14

References

• CVE Record
• NVD entry

Related

• CVE-2009-5147
• CVE-2015-7551
• CVE-2015-1835
• CVE-2015-1862
• CVE-2015-1833
• CVE-2015-1875