PRIOn knowledge basePRION:CVE-2007-5162Cross site request forgery (csrf)
6.2 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
70.3%
The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
References
secunia.com/advisories/26985
secunia.com/advisories/27044
secunia.com/advisories/27432
secunia.com/advisories/27576
secunia.com/advisories/27673
secunia.com/advisories/27756
secunia.com/advisories/27764
secunia.com/advisories/27769
secunia.com/advisories/27818
secunia.com/advisories/28645
secunia.com/advisories/29556
securityreason.com/securityalert/3180
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13499
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13500
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13502
svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13504
www.debian.org/security/2007/dsa-1410
www.debian.org/security/2007/dsa-1411
www.debian.org/security/2007/dsa-1412
www.isecpartners.com/advisories/2007-006-rubyssl.txt
www.mandriva.com/security/advisories?name=MDVSA-2008:029
www.novell.com/linux/security/advisories/2007_24_sr.html
www.redhat.com/support/errata/RHSA-2007-0961.html
www.redhat.com/support/errata/RHSA-2007-0965.html
www.securityfocus.com/archive/1/480987/100/0/threaded
www.securityfocus.com/archive/1/483577/100/0/threaded
www.securityfocus.com/bid/25847
www.ubuntu.com/usn/usn-596-1
www.vupen.com/english/advisories/2007/3340
bugzilla.redhat.com/show_bug.cgi?id=313791
exchange.xforce.ibmcloud.com/vulnerabilities/36861
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10738
www.redhat.com/archives/fedora-package-announce/2007-October/msg00087.html
www.redhat.com/archives/fedora-package-announce/2007-October/msg00097.html
www.redhat.com/archives/fedora-package-announce/2007-October/msg00391.html
Related
6.2 Medium
AI Score
Confidence
Low
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.003 Low
EPSS
Percentile
70.3%