Ruby CVE-2015-1855 Security Bypass Vulnerability

Bugtraq ID:	74446
Class:	Unknown
CVE:	CVE-2015-1855
Remote:	Yes
Local:	No
Published:	May 04 2015 12:00AM
Updated:	Jul 26 2017 10:08AM
Credit:	Tony Arcieri, Jeffrey Walton, and Steffan Ullrich
Vulnerable:	Ubuntu Ubuntu Linux 17.04 Ubuntu Ubuntu Linux 16.04 LTS Ubuntu Ubuntu Linux 14.04 LTS Ruby-Lang Ruby 2.1.4 Ruby-Lang Ruby 2.1.3 Ruby-Lang Ruby 2.1.2 Ruby-Lang Ruby 2.0 rc2 Ruby-Lang Ruby 2.2.0dev Ruby-Lang Ruby 2.1.5 Ruby-Lang Ruby 2.1.2p168 Ruby-Lang Ruby 2.1.1 Ruby-Lang Ruby 2.1 Preview1 Ruby-Lang Ruby 2.1 - Ruby-Lang Ruby 2.0.0-p594 Ruby-Lang Ruby 2.0.0 RC1 Ruby-Lang Ruby 2.0.0 Preview2 Ruby-Lang Ruby 2.0.0 Preview1 Ruby-Lang Ruby 2.0.0 P598 Ruby-Lang Ruby 2.0.0 P247 Ruby-Lang Ruby 2.0.0 P195 Ruby-Lang Ruby 2.0.0 P0 Ruby-Lang Ruby 2.0.0 Oracle Solaris 11.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apple Mac Os X 10.10.5 Apple Mac OS X 10.10 Apple Mac OS X 10.9.5 Apple Mac OS X 10.9.1 Apple Mac OS X 10.8.5 Apple Mac OS X 10.8.4 Apple Mac OS X 10.8.2 Apple Mac OS X 10.8.1 Apple Mac OS X 10.8 Apple Mac OS X 10.7 Apple Mac OS X 10.9.4 Apple Mac OS X 10.9.3 Apple Mac OS X 10.9.2 Apple Mac OS X 10.9 Apple Mac OS X 10.8.3 Apple Mac OS X 10.7.5 Apple Mac OS X 10.7.4 Apple Mac OS X 10.7.3 Apple Mac OS X 10.7.1 Apple Mac OS X 10.6.8 Apple Mac Os X 10.10.4 Apple Mac Os X 10.10.3 Apple Mac OS X 10.10.2 Apple Mac OS X 10.10.1
Not Vulnerable:	Ruby-Lang Ruby 2.2.2 Ruby-Lang Ruby 2.1.6 Ruby-Lang Ruby 2.0.0 patchlevel 645 Apple Mac Os X 10.11

Ruby CVE-2015-1855 Security Bypass Vulnerability

Ruby is prone to a security-bypass vulnerability.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Ruby CVE-2015-1855 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Ruby CVE-2015-1855 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Ruby CVE-2015-1855 Security Bypass Vulnerability

References:

• CVE-2015-1855: Ruby OpenSSL Hostname Verification (Ruby)
  
• Ruby Homepage (Yukihiro Matsumoto)
  
• Oracle Solaris Third Party Bulletin - July 2015 (Oracle)