CVE-2015-1828 http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Attackers can intercept sensitive data via man-in-the-middle attacks because the Ruby http gem fails to verify SSL hostnames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1828?
CVE-2015-1828 is a medium-severity vulnerability in n/a, published on 6 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Weakness: CWE-200
Which versions are affected by CVE-2015-1828?
4 open source packages ship an affected version, including http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
http RubyGems | All versions | 0.6.4 |
http RubyGems | All versions | 0.6.4 |
http RubyGems | From 0.7.0 | 0.7.3 |
http RubyGems | From 0.7.0 | 0.7.3 |
Products include Http.rb Project Http.rb.
How do I fix CVE-2015-1828?
Upgrade http to a fixed version for your release line: 0.6.4 or 0.7.3.
Is CVE-2015-1828 being exploited?
There is no known exploitation of CVE-2015-1828 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2015-1828, GHSA-6wpv-cj6x-v3jw.