ruby: SSL server spoofing [LWN.net]

Package(s):

ruby

CVE #(s):

CVE-2013-4073

Created:

June 28, 2013

Updated:

August 6, 2013

Description:

From the Ruby advisory:

When a CA a SSL client trusts allows to issue the server certificate that has null byte in subjectAltName, remote attackers can obtain the certificate for ‘www.ruby-lang.org\0.example.com’ from the CA to spoof ‘www.ruby-lang.org’ and do man-in-the-middle between Ruby’s SSL client and SSL servers.

Alerts:

Slackware	SSA:2013-178-01	2013-06-27
Ubuntu	USN-1902-1	2013-07-09
openSUSE	openSUSE-SU-2013:1186-1	2013-07-12
Fedora	FEDORA-2013-12663	2013-07-16
Fedora	FEDORA-2013-12123	2013-07-11
Fedora	FEDORA-2013-12062	2013-07-11
openSUSE	openSUSE-SU-2013:1179-1	2013-07-11
openSUSE	openSUSE-SU-2013:1181-1	2013-07-11
Red Hat	RHSA-2013:1090-01	2013-07-17
Oracle	ELSA-2013-1090	2013-07-17
Oracle	ELSA-2013-1090	2013-07-17
Scientific Linux	SL-ruby-20130717	2013-07-17
CentOS	CESA-2013:1090	2013-07-17
CentOS	CESA-2013:1090	2013-07-17
Red Hat	RHSA-2013:1103-01	2013-07-23
Mandriva	MDVSA-2013:201	2013-07-26
Red Hat	RHSA-2013:1137-01	2013-08-05
Debian	DSA-2738-1	2013-08-18

(Log in to post comments)