[SECURITY] [DLA 224-1] ruby1.8 security update

2015-05-1821:57:18

lists.debian.org

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.028 Low

EPSS

Percentile

90.5%

JSON

Package : ruby1.8
Version : 1.8.7.302-2squeeze4
CVE ID : CVE-2015-1855

It was discovered that the Ruby OpenSSL extension, part of the
interpreter for the Ruby language, did not properly implement hostname
matching, in violation of RFC 6125. This could allow remote attackers to
perform a man-in-the-middle attack via crafted SSL certificates.

For the oldoldstable distribution (squeeze), this problem has been
fixed in version 1.8.7.302-2squeeze4.

For the oldstable distribution (wheezy), this problem was fixed in
version 1.8.7.358-7.1+deb7u3.

–
Ben Hutchings - Debian developer, member of Linux kernel and LTS teams

Attachment:
signature.asc
Description: This is a digitally signed message part

OSVersionArchitecturePackageVersionFilename
Debian7s390libruby1.8-dbg< 1.8.7.358-7.1+deb7u3libruby1.8-dbg_1.8.7.358-7.1+deb7u3_s390.deb
Debian7amd64libruby1.8-dbg< 1.8.7.358-7.1+deb7u3libruby1.8-dbg_1.8.7.358-7.1+deb7u3_amd64.deb
Debian8mipsruby2.1< 2.1.5-2+deb8u1ruby2.1_2.1.5-2+deb8u1_mips.deb
Debian7mipsellibruby1.9.1-dbg< 1.9.3.194-8.1+deb7u5libruby1.9.1-dbg_1.9.3.194-8.1+deb7u5_mipsel.deb
Debian7allri1.9.1< 1.9.3.194-8.1+deb7u5ri1.9.1_1.9.3.194-8.1+deb7u5_all.deb
Debian7mipsellibruby1.8-dbg< 1.8.7.358-7.1+deb7u3libruby1.8-dbg_1.8.7.358-7.1+deb7u3_mipsel.deb
Debian8s390xlibruby2.1< 2.1.5-2+deb8u1libruby2.1_2.1.5-2+deb8u1_s390x.deb
Debian6amd64libruby1.8-dbg< 1.8.7.302-2squeeze4libruby1.8-dbg_1.8.7.302-2squeeze4_amd64.deb
Debian7armellibruby1.9.1-dbg< 1.9.3.194-8.1+deb7u5libruby1.9.1-dbg_1.9.3.194-8.1+deb7u5_armel.deb
Debian8powerpcruby2.1< 2.1.5-2+deb8u1ruby2.1_2.1.5-2+deb8u1_powerpc.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	s390	libruby1.8-dbg	< 1.8.7.358-7.1+deb7u3	libruby1.8-dbg_1.8.7.358-7.1+deb7u3_s390.deb
Debian	7	amd64	libruby1.8-dbg	< 1.8.7.358-7.1+deb7u3	libruby1.8-dbg_1.8.7.358-7.1+deb7u3_amd64.deb
Debian	8	mips	ruby2.1	< 2.1.5-2+deb8u1	ruby2.1_2.1.5-2+deb8u1_mips.deb
Debian	7	mipsel	libruby1.9.1-dbg	< 1.9.3.194-8.1+deb7u5	libruby1.9.1-dbg_1.9.3.194-8.1+deb7u5_mipsel.deb
Debian	7	all	ri1.9.1	< 1.9.3.194-8.1+deb7u5	ri1.9.1_1.9.3.194-8.1+deb7u5_all.deb
Debian	7	mipsel	libruby1.8-dbg	< 1.8.7.358-7.1+deb7u3	libruby1.8-dbg_1.8.7.358-7.1+deb7u3_mipsel.deb
Debian	8	s390x	libruby2.1	< 2.1.5-2+deb8u1	libruby2.1_2.1.5-2+deb8u1_s390x.deb
Debian	6	amd64	libruby1.8-dbg	< 1.8.7.302-2squeeze4	libruby1.8-dbg_1.8.7.302-2squeeze4_amd64.deb
Debian	7	armel	libruby1.9.1-dbg	< 1.9.3.194-8.1+deb7u5	libruby1.9.1-dbg_1.9.3.194-8.1+deb7u5_armel.deb
Debian	8	powerpc	ruby2.1	< 2.1.5-2+deb8u1	ruby2.1_2.1.5-2+deb8u1_powerpc.deb