Detections
Analytics

FreeBSD : Ruby -- OpenSSL Hostname Verification Vulnerability (d4379f59-3e9b-49eb-933b-61de4d0b0fdb)

medium Nessus Plugin ID 82753

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Ruby Developers report :

After reviewing RFC 6125 and RFC 5280, we found multiple violations of matching hostnames and particularly wildcard certificates.

Ruby's OpenSSL extension will now provide a string-based matching algorithm which follows more strict behavior, as recommended by these RFCs. In particular, matching of more than one wildcard per subject/SAN is no-longer allowed. As well, comparison of these values are now case-insensitive.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?291d9038

http://www.nessus.org/u?de17f4c6

Plugin Details

Severity: Medium

ID: 82753

File Name: freebsd_pkg_d4379f593e9b49eb933b61de4d0b0fdb.nasl

Version: 1.9

Type: local

Published: 4/14/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:ruby, p-cpe:/a:freebsd:freebsd:ruby20, p-cpe:/a:freebsd:freebsd:ruby21, p-cpe:/a:freebsd:freebsd:ruby22, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 4/14/2015

Vulnerability Publication Date: 4/13/2015

Reference Information

CVE: CVE-2015-1855