Bug 1209981 (CVE-2015-1855) - CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125
Summary: CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violat...
Alias: CVE-2015-1855
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1209982 1209983
Blocks: 1225764
TreeView+ depends on / blocked
Reported: 2015-04-08 15:12 UTC by Vasyl Kaigorodov
Modified: 2021-10-21 00:44 UTC (History)
39 users (show)

Fixed In Version: ruby 2.0.0p645, ruby 2.1.6, ruby 2.2.2
Doc Type: Bug Fix
Doc Text:
It was discovered that the Ruby OpenSSL extension was overly permissive when verifying host names against X.509 certificate names with wildcards. This could cause Ruby TLS/SSL clients to accept certain certificates as valid, which is a violation of the RFC 6125 recommendations.
Clone Of:
Last Closed: 2021-10-21 00:44:11 UTC

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-04-08 15:12:16 UTC
Ruby OpenSSL hostname matching implementation violates RFC 6125.

- Wildcard matching code allowed multiple wildcards (e.g. *.*.*)
- Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

Upstream patch:

Comment 2 Vasyl Kaigorodov 2015-04-08 15:13:45 UTC
Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1209982]

Comment 4 Tomas Hoger 2015-06-09 19:43:54 UTC
Fixed upstream in Ruby versions: 2.0.0p645, 2.1.6, and 2.2.2

Upstream bug report:

Upstream commit in ruby SVN:

External References:

Comment 5 Tomas Hoger 2015-06-10 21:01:55 UTC
(In reply to Vasyl Kaigorodov from comment #0)
> - Wildcard matching code allowed multiple wildcards (e.g. *.*.*)

This issue can only be exploited when trusted CA issues a certificated with multiple wildcards, which is unlikely / uncommon.

> - Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

This problem is not considered as needing CVE, see:


Comment 6 Tomas Hoger 2015-06-10 21:03:13 UTC

This issue affects the versions of Ruby as shipped with Red Hat Enterprise Linux 5, 6, and 7, and Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future updates may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.