Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Ruby Net::HTTP库不安全验证服务器证书CN漏洞
Vulnerability Description
Ruby是一种功能强大的面向对象的脚本语言。 Ruby的Net::HTTPS库的实现上存在漏洞，攻击者可能利用此漏洞获取会话中的敏感信息。 Ruby的Net::HTTPS库没有对用户所请求的DNS名称验证SSL证书名称，在协商SSL连接后http.rb文件中的connect方式没有调用post_connection_check。由于没有对所请求的DNS名称验证服务器证书CN，攻击者就可以扮演成为SSL连接中的目标服务器，破坏SSL连接的保密性和完整性。
CVSS Information
N/A
Vulnerability Type
N/A