Description
The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | ruby1.8 | 1.8.5-4etch1 | DSA-1410-1 |
| Debian 4.0 | ruby1.9 | 1.9.0+20060609-1etch1 | DSA-1412-1 |
| Debian 3.1 | libopenssl-ruby | 0.1.4a-1sarge1 | DSA-1411-1 |
| Debian 3.1 | ruby1.8 | 1.8.2-7sarge6 | DSA-1410-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ruby +8 | 1.8.5-5.el5_1.1 | RHSA-2007:0965 |
| RHEL 4 | irb +6 | 1.8.1-7.EL4.8.1 | RHSA-2007:0961 |
Advisories 5
- RHSA-2007:0965 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0961 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1412-1 ruby1.9 - possible man-in-the-middle attacks Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1411-1 libopenssl-ruby - possible man-in-the-middle attacks Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1410-1 ruby1.8 - possible man-in-the-middle attacks Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13499
- 25847 vdb-entry
- 20071112 FLEA-2007-0068-1 ruby mailing-list
- 27576 third-party-advisory
- 26985 third-party-advisory
- ADV-2007-3340 vdb-entry
- USN-596-1 vendor-advisory
- ruby-nethttps-mitm(36861) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=313791
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13500
- FEDORA-2007-2685 vendor-advisory
- 27044 third-party-advisory
- RHSA-2007:0961 vendor-advisory
- RHSA-2007:0965 vendor-advisory
- 27756 third-party-advisory
- DSA-1412 vendor-advisory
- http://www.isecpartners.com/advisories/2007-006-rubyssl.txt
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13502
- 27673 third-party-advisory
- oval:org.mitre.oval:def:10738 vdb-entry signature
- DSA-1410 vendor-advisory
- 27769 third-party-advisory
- FEDORA-2007-718 vendor-advisory
- SUSE-SR:2007:024 vendor-advisory
- MDVSA-2008:029 vendor-advisory
- 29556 third-party-advisory
- 27818 third-party-advisory
- 27432 third-party-advisory
- 20070927 Ruby Net::HTTPS library does not validate server certificate CN mailing-list
- 3180 third-party-advisory
- FEDORA-2007-2406 vendor-advisory
- 28645 third-party-advisory
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13504
- DSA-1411 vendor-advisory
- 27764 third-party-advisory