Skip to content
OpenAdvisories
Critical USN-3808-1 2 CVEs

ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities

Published Nov 5, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby incorrectly handled certain X.509
certificates. An attacker could possibly use this issue to
bypass the certificate check. (CVE-2018-16395)

It was discovered that Ruby incorrectly handled certain
inputs. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2018-16396)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS ruby1.9.1 1.9.3.484-2ubuntu1.13
Ubuntu · 14.04 LTS 14.04:LTS ruby2.0 2.0.0.484-1ubuntu2.11
Ubuntu · 16.04 LTS 16.04:LTS ruby2.3 2.3.1-2~16.04.11
Ubuntu · 18.04 LTS 18.04:LTS ruby2.5 2.5.1-1ubuntu1.1

Vulnerabilities 2

  • Critical 9.8
    CVE-2018-16395 EPSS 11%

    Ruby Openssl Allows Incorrect Value Comparison

    An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return t…

    ruby2.3 ruby ruby2.5 ruby2.0 Ubuntu Alpine RubyGems
  • Unscored —
    CVE-2018-16396

    An issue was discovered in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. …

    ruby2.3 ruby ruby2.5 ruby2.0 Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-16395
  • report
    https://ubuntu.com/security/CVE-2018-16396