Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Ruby 加密问题漏洞
Vulnerability Description
Ruby是松本行弘个人开发者的一种跨平台、面向对象的动态类型编程语言。 Ruby中的lib/openssl/ssl.rb文件中的OpenSSL::SSL.verify_certificate_identity函数中存在加密问题漏洞。Ruby SSL客户端没有正确处理X.509证书的Subject Alternative Name中带有空字节的主机名。攻击者可通过中间人攻击利用该漏洞欺骗SSL服务器。成功的利用此漏洞需要获得由权威机构签署并且客户信任的证书。以下版本中存在漏洞：Ruby 1.8.7-p374
CVSS Information
N/A
Vulnerability Type
N/A