Vulnerability CVE-2007-5162: Information

Description

The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

Severity: MEDIUM (4.3)

References to Advisories, Solutions, and Tools

1. Affected configurations:

   1. Configuration 1

      cpe:2.3:a:ruby-lang:ruby:1.8.5:*:*:*:*:*:*:*

      ---

      cpe:2.3:a:ruby-lang:ruby:1.8.6:*:*:*:*:*:*:*

      ---