Bug 1209981 (CVE-2015-1855) - CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125
Summary: CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violat...
Status: NEW
Alias: CVE-2015-1855
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20150330,repor...
Keywords: Security
Depends On: 1209982 1209983
Blocks: 1225764
TreeView+ depends on / blocked
 
Reported: 2015-04-08 15:12 UTC by Vasyl Kaigorodov
Modified: 2019-04-05 03:04 UTC (History)
43 users (show)

Fixed In Version: ruby 2.0.0p645, ruby 2.1.6, ruby 2.2.2
Doc Type: Bug Fix
Doc Text:
It was discovered that the Ruby OpenSSL extension was overly permissive when verifying host names against X.509 certificate names with wildcards. This could cause Ruby TLS/SSL clients to accept certain certificates as valid, which is a violation of the RFC 6125 recommendations.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-04-08 15:12:16 UTC
Ruby OpenSSL hostname matching implementation violates RFC 6125.

- Wildcard matching code allowed multiple wildcards (e.g. *.*.*)
- Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

Upstream patch:
https://github.com/ruby/openssl/commit/e9a7bcb8bf2902f907c148a00bbcf21d3fa79596

Comment 2 Vasyl Kaigorodov 2015-04-08 15:13:45 UTC
Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1209982]

Comment 4 Tomas Hoger 2015-06-09 19:43:54 UTC
Fixed upstream in Ruby versions: 2.0.0p645, 2.1.6, and 2.2.2

Upstream bug report:
https://bugs.ruby-lang.org/issues/9644

Upstream commit in ruby SVN:
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=50292

External References:
https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/

Comment 5 Tomas Hoger 2015-06-10 21:01:55 UTC
(In reply to Vasyl Kaigorodov from comment #0)
> - Wildcard matching code allowed multiple wildcards (e.g. *.*.*)

This issue can only be exploited when trusted CA issues a certificated with multiple wildcards, which is unlikely / uncommon.

> - Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

This problem is not considered as needing CVE, see:

http://seclists.org/oss-sec/2015/q2/523

Comment 6 Tomas Hoger 2015-06-10 21:03:13 UTC
Statement:

This issue affects the versions of Ruby as shipped with Red Hat Enterprise Linux 5, 6, and 7, and Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future updates may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.