CVE-2018-16395 Ruby Openssl Allows Incorrect Value Comparison
Flawed certificate comparison in Ruby's OpenSSL allows accepting illegitimate certificates, bypassing security checks for signing or encryption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16395?
CVE-2018-16395 is a critical vulnerability in Canonical Ubuntu Linux, published on 16 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
Which versions are affected by CVE-2018-16395?
4 open source packages ship an affected version, including openssl. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
openssl RubyGems | All versions | 2.0.9 |
openssl RubyGems | All versions | 2.0.9 |
openssl RubyGems | From 2.1.0 | 2.1.2 |
openssl RubyGems | From 2.1.0 | 2.1.2 |
Linux distribution packages (36)
ruby Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
ruby-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
ruby-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
ruby-doc Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
ruby-irb Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
ruby-libs Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
ruby-tcltk Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0.648-34.el7_6 |
rubygem-bigdecimal Red Hat:enterprise_linux:7::client | All versions | 0:1.2.0-34.el7_6 |
rubygem-io-console Red Hat:enterprise_linux:7::client | All versions | 0:0.4.2-34.el7_6 |
rubygem-json Red Hat:enterprise_linux:7::client | All versions | 0:1.7.7-34.el7_6 |
rubygem-minitest Red Hat:enterprise_linux:7::client | All versions | 0:4.3.2-34.el7_6 |
rubygem-psych Red Hat:enterprise_linux:7::client | All versions | 0:2.0.0-34.el7_6 |
rubygem-rake Red Hat:enterprise_linux:7::client | All versions | 0:0.9.6-34.el7_6 |
rubygem-rdoc Red Hat:enterprise_linux:7::client | All versions | 0:4.0.0-34.el7_6 |
rubygems Red Hat:enterprise_linux:7::client | All versions | 0:2.0.14.1-34.el7_6 |
rubygems-devel Red Hat:enterprise_linux:7::client | All versions | 0:2.0.14.1-34.el7_6 |
ruby Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
ruby-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
ruby-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
ruby-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
ruby-irb Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
ruby-libs Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
ruby-tcltk Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0.648-34.el7_6 |
rubygem-bigdecimal Red Hat:enterprise_linux:7::computenode | All versions | 0:1.2.0-34.el7_6 |
rubygem-io-console Red Hat:enterprise_linux:7::computenode | All versions | 0:0.4.2-34.el7_6 |
rubygem-json Red Hat:enterprise_linux:7::computenode | All versions | 0:1.7.7-34.el7_6 |
rubygem-minitest Red Hat:enterprise_linux:7::computenode | All versions | 0:4.3.2-34.el7_6 |
rubygem-psych Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.0-34.el7_6 |
rubygem-rake Red Hat:enterprise_linux:7::computenode | All versions | 0:0.9.6-34.el7_6 |
rubygem-rdoc Red Hat:enterprise_linux:7::computenode | All versions | 0:4.0.0-34.el7_6 |
rubygems Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.14.1-34.el7_6 |
rubygems-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:2.0.14.1-34.el7_6 |
ruby Red Hat:enterprise_linux:7::server | All versions | 0:2.0.0.648-34.el7_6 |
ruby-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:2.0.0.648-34.el7_6 |
ruby-devel Red Hat:enterprise_linux:7::server | All versions | 0:2.0.0.648-34.el7_6 |
ruby-doc Red Hat:enterprise_linux:7::server | All versions | 0:2.0.0.648-34.el7_6 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Redhat Enterprise Linux, Ruby-Lang Openssl, Ruby-Lang Ruby.
How do I fix CVE-2018-16395?
Upgrade openssl to a fixed version for your release line: 2.0.9 or 2.1.2.
Is CVE-2018-16395 being exploited?
There is no known exploitation of CVE-2018-16395 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-16395, CLEANSTART-2026-QW33820, GHSA-mmrq-6999-72v8, RHSA-2018:3738, RHSA-2019:1948, RHSA-2019:2565 and 1 more.