[RUBYSEC:OPENSSL-2018-16395] Incorrect value comparison in Ruby openssl

Severity Critical
Affected Packages 1
Fixed Packages 1
CVEs 1

An issue was discovered in the OpenSSL library in Ruby when two OpenSSL::X509::Name
objects are compared using ==, depending on the ordering, non-equal objects may
return true. When the first argument is one character longer than the second, or
the second argument contains a character that is one less than a character in the
same position of the first argument, the result of == will be true. This could be
leveraged to create an illegitimate certificate that may be accepted as legitimate
and then used in signing or encryption operations.

Package Affected Version
pkg:gem/openssl < 2.1.2
Package Fixed Version
pkg:gem/openssl >= 2.1.2
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Fixed pkg:gem/openssl openssl >= 2.1.2
Affected pkg:gem/openssl openssl < 2.1.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date
Loading...