Bug 1209981 (CVE-2015-1855)

Summary:	CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, apevec, bkearney, cbillett, ccoleman, chrisw, dajohnso, dallan, dmcphers, gkotton, gmccullo, hhorak, jhardy, jialiu, joelsmith, jokerman, jorton, jprause, jvlcek, katello-bugs, lhh, lmeyer, lpeer, markmc, mburns, mmaslano, mmccomas, mtasaka, nicholas_schuetz, philfest, rbryant, sclewis, srevivo, s, tagoh, tomckay, vanmeeuwen+fedora, vondruch, xlecauch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ruby 2.0.0p645, ruby 2.1.6, ruby 2.2.2	Doc Type:	Bug Fix
Doc Text:	It was discovered that the Ruby OpenSSL extension was overly permissive when verifying host names against X.509 certificate names with wildcards. This could cause Ruby TLS/SSL clients to accept certain certificates as valid, which is a violation of the RFC 6125 recommendations.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 00:44:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1209982, 1209983
Bug Blocks:	1225764

Description Vasyl Kaigorodov 2015-04-08 15:12:16 UTC

Ruby OpenSSL hostname matching implementation violates RFC 6125.

- Wildcard matching code allowed multiple wildcards (e.g. *.*.*)
- Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

Upstream patch:
https://github.com/ruby/openssl/commit/e9a7bcb8bf2902f907c148a00bbcf21d3fa79596

Comment 2 Vasyl Kaigorodov 2015-04-08 15:13:45 UTC

Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1209982]

Comment 4 Tomas Hoger 2015-06-09 19:43:54 UTC

Fixed upstream in Ruby versions: 2.0.0p645, 2.1.6, and 2.2.2

Upstream bug report:
https://bugs.ruby-lang.org/issues/9644

Upstream commit in ruby SVN:
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=50292

External References:
https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/

Comment 5 Tomas Hoger 2015-06-10 21:01:55 UTC

(In reply to Vasyl Kaigorodov from comment #0)
> - Wildcard matching code allowed multiple wildcards (e.g. *.*.*)

This issue can only be exploited when trusted CA issues a certificated with multiple wildcards, which is unlikely / uncommon.

> - Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

This problem is not considered as needing CVE, see:

http://seclists.org/oss-sec/2015/q2/523

Comment 6 Tomas Hoger 2015-06-10 21:03:13 UTC

Statement:

This issue affects the versions of Ruby as shipped with Red Hat Enterprise Linux 5, 6, and 7, and Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future updates may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.