http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

2018-03-1316:15:57

Google

osv.dev

0.002 Low

EPSS

Percentile

52.0%

JSON

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

CPENameOperatorVersion
httpeq0.5.0
httpeq0.7.2
httpeq0.0.2
httpeq0.5.0.pre
httpeq0.2.0
httpeq0.6.0.pre
httpeq0.7.0
httpeq0.6.0
httpeq0.6.4
httpeq0.0.1