Description
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | ruby1.8 | 1.8.7.358-7.1+deb7u1 | DSA-2809-1 |
| Debian 7 | ruby1.9.1 | 1.9.3.194-8.1+deb7u1 | DSA-2738-1 |
| Debian 6.0 | ruby1.8 | 1.8.7.302-2squeeze2 | DSA-2809-1 |
| Debian 6.0 | ruby1.9.1 | 1.9.2.0-2+deb6u1 | DSA-2738-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | ruby +8 | 1.8.7.352-12.el6_4 | RHSA-2013:1090 |
| RHEL 5 | ruby +8 | 1.8.5-31.el5_9 | RHSA-2013:1090 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | ruby193-ruby +5 | 1.9.3.429-34.2.el6ost | RHSA-2013:1103 |
| Red Hat OpenStack 3 | ruby193-rubygem-bigdecimal | 1.1.0-34.2.el6ost | RHSA-2013:1103 |
| Red Hat OpenStack 3 | ruby193-rubygem-io-console | 0.3-34.2.el6ost | RHSA-2013:1103 |
| Red Hat OpenStack 3 | ruby193-rubygem-json | 1.5.5-34.2.el6ost | RHSA-2013:1103 |
| Red Hat OpenStack 3 | ruby193-rubygem-minitest | 2.5.1-34.2.el6ost | RHSA-2013:1103 |
| Red Hat OpenStack 3 | ruby193-rubygem-rake | 0.9.2.2-34.2.el6ost | RHSA-2013:1103 |
| Red Hat OpenShift 1 | ruby193-ruby +5 | 1.9.3.448-38.el6 | RHSA-2013:1137 |
| Red Hat OpenShift 1 | ruby193-rubygem-bigdecimal | 1.1.0-38.el6 | RHSA-2013:1137 |
| Red Hat OpenShift 1 | ruby193-rubygem-io-console | 0.3-38.el6 | RHSA-2013:1137 |
| Red Hat OpenShift 1 | ruby193-rubygem-json | 1.5.5-38.el6 | RHSA-2013:1137 |
| Red Hat OpenShift 1 | ruby193-rubygem-rake | 0.9.2.2-38.el6 | RHSA-2013:1137 |
| Red Hat OpenShift 1 | ruby193-rubygem-rdoc | 3.9.5-38.el6 | RHSA-2013:1137 |
| Red Hat OpenShift 1 | ruby193-rubygems +1 | 1.8.23-38.el6 | RHSA-2013:1137 |
Advisories 6
- RHSA-2013:1090 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2738-1 ruby1.9.1 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2809-1 ruby1.8 - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2013:1103 Red Hat Security Advisory: ruby193-ruby security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- RHSA-2013:1137 Red Hat Security Advisory: ruby193-ruby security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
- WID-SEC-2025-0864 Ruby: Schwachstelle ermöglicht Man-in-the-Middle Angriff BSI CERT-Bund (WID) · Apr 22, 2025
References
- DSA-2738 vendor-advisory
- USN-1902-1 vendor-advisory
- http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21
- RHSA-2013:1090 vendor-advisory
- RHSA-2013:1103 vendor-advisory
- APPLE-SA-2013-10-22-3 vendor-advisory
- http://support.apple.com/kb/HT6150
- https://puppet.com/security/cve/cve-2013-4073
- https://bugzilla.redhat.com/show_bug.cgi?id=979251
- openSUSE-SU-2013:1181 vendor-advisory
- RHSA-2013:1137 vendor-advisory
- openSUSE-SU-2013:1186 vendor-advisory
- DSA-2809 vendor-advisory
- http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/