6.8
CVSSv2

CVE-2009-0642

Published: 20/02/2009 Updated: 29/09/2017
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Summary

ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote malicious users to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.

Vulnerable Product Search on Vulmon Subscribe to Product

ruby-lang ruby 1.9

ruby-lang ruby 1.8

Vendor Advisories

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix multiple security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team D ...
It was discovered that Ruby did not properly validate certificates An attacker could exploit this and present invalid or revoked X509 certificates (CVE-2009-0642) ...
Several vulnerabilities have been discovered in Ruby The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0642 The return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate CVE-2009-1904 An issue in parsing BigDecimal numbers can result ...