9.8

CVE-2018-16395

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ruby-lang ≫ Openssl SwPlatformruby Version < 2.1.2
Ruby-lang ≫ Ruby Version >= 2.3.0 <= 2.3.7
Ruby-lang ≫ Ruby Version >= 2.4.0 <= 2.4.4
Ruby-lang ≫ Ruby Version >= 2.5.0 <= 2.5.1
Ruby-lang ≫ Ruby Version2.6.0 Updatepreview1
Ruby-lang ≫ Ruby Version2.6.0 Updatepreview2
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Redhat ≫ Enterprise Linux Version7.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.72% 0.952
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://www.oracle.com/security-alerts/cpujan2020.html
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHSA-2018:3729
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3730
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3731
Third Party Advisory
http://www.securitytracker.com/id/1042105
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3738
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1948
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2565
https://hackerone.com/reports/387250
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/10/msg00020.html
Third Party Advisory
https://security.netapp.com/advisory/ntap-20190221-0002/
Third Party Advisory
https://usn.ubuntu.com/3808-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4332
Third Party Advisory
https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/
Vendor Advisory
Mitigation
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/
Vendor Advisory
Release Notes
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/
Vendor Advisory
Release Notes
https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/
Vendor Advisory
Release Notes
https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/
Vendor Advisory
Release Notes