Bug 1209981 (CVE-2015-1855) - CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violates RFC 6125
Summary: CVE-2015-1855 ruby: OpenSSL extension hostname matching implementation violat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-1855
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1209982 1209983
Blocks: 1225764
TreeView+ depends on / blocked
 
Reported: 2015-04-08 15:12 UTC by Vasyl Kaigorodov
Modified: 2021-10-21 00:44 UTC (History)
39 users (show)

Fixed In Version: ruby 2.0.0p645, ruby 2.1.6, ruby 2.2.2
Doc Type: Bug Fix
Doc Text:
It was discovered that the Ruby OpenSSL extension was overly permissive when verifying host names against X.509 certificate names with wildcards. This could cause Ruby TLS/SSL clients to accept certain certificates as valid, which is a violation of the RFC 6125 recommendations.
Clone Of:
Environment:
Last Closed: 2021-10-21 00:44:11 UTC
Embargoed:

Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-04-08 15:12:16 UTC 
Ruby OpenSSL hostname matching implementation violates RFC 6125.

- Wildcard matching code allowed multiple wildcards (e.g. *.*.*)
- Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

Upstream patch:
https://github.com/ruby/openssl/commit/e9a7bcb8bf2902f907c148a00bbcf21d3fa79596
Comment 2 Vasyl Kaigorodov 2015-04-08 15:13:45 UTC 
Created ruby tracking bugs for this issue:

Affects: fedora-all [bug 1209982]
Comment 4 Tomas Hoger 2015-06-09 19:43:54 UTC 
Fixed upstream in Ruby versions: 2.0.0p645, 2.1.6, and 2.2.2

Upstream bug report:
https://bugs.ruby-lang.org/issues/9644

Upstream commit in ruby SVN:
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=50292

External References:
https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/
Comment 5 Tomas Hoger 2015-06-10 21:01:55 UTC 
(In reply to Vasyl Kaigorodov from comment #0)
> - Wildcard matching code allowed multiple wildcards (e.g. *.*.*)

This issue can only be exploited when trusted CA issues a certificated with multiple wildcards, which is unlikely / uncommon.

> - Wildcards were mishandled for IDNA names (ala CVE-2014-1492)

This problem is not considered as needing CVE, see:

http://seclists.org/oss-sec/2015/q2/523
Comment 6 Tomas Hoger 2015-06-10 21:03:13 UTC 
Statement:

This issue affects the versions of Ruby as shipped with Red Hat Enterprise Linux 5, 6, and 7, and Red Hat Software Collections. Red Hat Product Security has rated this issue as having Moderate security impact. A future updates may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
Note You need to log in before you can comment on or make changes to this bug.