CVE-2015-1828

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-1828
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

5.9 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://rubysec.com/advisories/http-CVE-2015-1828 Third Party Advisory
https://github.com/ruby/openssl/issues/8 Issue Tracking Third Party Advisory
https://groups.google.com/forum/#%21topic/httprb/jkb4oxwZjkU
Configurations

Configuration 1 (hide)

cpe:2.3:a:http.rb_project:http.rb:*:*:*:*:*:ruby:*:*
History

07 Nov 2023, 02:24

Type Values Removed Values Added
References
  • {'url': 'https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU', 'name': 'https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • () https://groups.google.com/forum/#%21topic/httprb/jkb4oxwZjkU -
Information

Published : 2017-10-06 22:29

Updated : 2023-11-07 02:24

NVD link : CVE-2015-1828

Mitre link : CVE-2015-1828

JSON object : View

Products Affected

http.rb_project

  • http.rb
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor