csaf_redhat - rhsa-2013:1137

rhsa-2013:1137

Vulnerability from csaf_redhat

Published

2013-08-05 16:00

Modified

2024-11-22 06:48

Summary

Red Hat Security Advisory: ruby193-ruby security update

Notes

Topic

Updated ruby193-ruby packages that fix one security issue are now available for Red Hat OpenShift Enterprise 1.2.2. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Details

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A flaw was found in Ruby's SSL client's hostname identity check when handling certificates that contain hostnames with NULL bytes. An attacker could potentially exploit this flaw to conduct man-in-the-middle attacks to spoof SSL servers. Note that to exploit this issue, an attacker would need to obtain a carefully-crafted certificate signed by an authority that the client trusts. (CVE-2013-4073) All users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to these updated packages, which resolve this issue.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated ruby193-ruby packages that fix one security issue are now available\nfor Red Hat OpenShift Enterprise 1.2.2.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby is an extensible, interpreted, object-oriented, scripting language.\nIt has features to process text files and to do system management tasks.\n\nA flaw was found in Ruby\u0027s SSL client\u0027s hostname identity check when\nhandling certificates that contain hostnames with NULL bytes. An attacker\ncould potentially exploit this flaw to conduct man-in-the-middle attacks to\nspoof SSL servers. Note that to exploit this issue, an attacker would need\nto obtain a carefully-crafted certificate signed by an authority that the\nclient trusts. (CVE-2013-4073)\n\nAll users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to\nthese updated packages, which resolve this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2013:1137",
        "url": "https://access.redhat.com/errata/RHSA-2013:1137"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/",
        "url": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/"
      },
      {
        "category": "external",
        "summary": "979251",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=979251"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1137.json"
      }
    ],
    "title": "Red Hat Security Advisory: ruby193-ruby security update",
    "tracking": {
      "current_release_date": "2024-11-22T06:48:34+00:00",
      "generator": {
        "date": "2024-11-22T06:48:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2013:1137",
      "initial_release_date": "2013-08-05T16:00:00+00:00",
      "revision_history": [
        {
          "date": "2013-08-05T16:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2013-08-05T16:03:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T06:48:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHOSE Infrastructure 1.2",
                "product": {
                  "name": "RHOSE Infrastructure 1.2",
                  "product_id": "6Server-RHOSE-INFRA-1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:1.2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Enterprise Node",
                "product": {
                  "name": "Red Hat OpenShift Enterprise Node",
                  "product_id": "6Server-RHOSE-NODE-1.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:1.2::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
                "product": {
                  "name": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
                  "product_id": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby-libs@1.9.3.448-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
                "product": {
                  "name": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
                  "product_id": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby@1.9.3.448-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
                "product": {
                  "name": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
                  "product_id": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygem-json@1.5.5-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
                "product": {
                  "name": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
                  "product_id": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygem-bigdecimal@1.1.0-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
                "product": {
                  "name": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
                  "product_id": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby-debuginfo@1.9.3.448-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
                "product": {
                  "name": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
                  "product_id": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygem-io-console@0.3-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
                "product": {
                  "name": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
                  "product_id": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby-doc@1.9.3.448-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
                "product": {
                  "name": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
                  "product_id": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby-tcltk@1.9.3.448-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
                "product": {
                  "name": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
                  "product_id": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby-devel@1.9.3.448-38.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
                "product": {
                  "name": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
                  "product_id": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygem-rdoc@3.9.5-38.el6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
                "product": {
                  "name": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
                  "product_id": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygem-rake@0.9.2.2-38.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
                "product": {
                  "name": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
                  "product_id": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby-irb@1.9.3.448-38.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
                "product": {
                  "name": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
                  "product_id": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygems-devel@1.8.23-38.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ruby193-rubygems-0:1.8.23-38.el6.noarch",
                "product": {
                  "name": "ruby193-rubygems-0:1.8.23-38.el6.noarch",
                  "product_id": "ruby193-rubygems-0:1.8.23-38.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-rubygems@1.8.23-38.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ruby193-ruby-0:1.9.3.448-38.el6.src",
                "product": {
                  "name": "ruby193-ruby-0:1.9.3.448-38.el6.src",
                  "product_id": "ruby193-ruby-0:1.9.3.448-38.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ruby193-ruby@1.9.3.448-38.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-0:1.9.3.448-38.el6.src as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src"
        },
        "product_reference": "ruby193-ruby-0:1.9.3.448-38.el6.src",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch"
        },
        "product_reference": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch"
        },
        "product_reference": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64 as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygems-0:1.8.23-38.el6.noarch as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch"
        },
        "product_reference": "ruby193-rubygems-0:1.8.23-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch as a component of RHOSE Infrastructure 1.2",
          "product_id": "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch"
        },
        "product_reference": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-INFRA-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-0:1.9.3.448-38.el6.src as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src"
        },
        "product_reference": "ruby193-ruby-0:1.9.3.448-38.el6.src",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch"
        },
        "product_reference": "ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64"
        },
        "product_reference": "ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch"
        },
        "product_reference": "ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64"
        },
        "product_reference": "ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygems-0:1.8.23-38.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch"
        },
        "product_reference": "ruby193-rubygems-0:1.8.23-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
          "product_id": "6Server-RHOSE-NODE-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch"
        },
        "product_reference": "ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
        "relates_to_product_reference": "6Server-RHOSE-NODE-1.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4073",
      "discovery_date": "2013-06-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "979251"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a \u0027\\0\u0027 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ruby: hostname check bypassing vulnerability in SSL client",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch",
          "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch",
          "6Server-RHOSE-NODE-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4073"
        },
        {
          "category": "external",
          "summary": "RHBZ#979251",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=979251"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4073",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4073"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4073",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4073"
        },
        {
          "category": "external",
          "summary": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/",
          "url": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/"
        }
      ],
      "release_date": "2013-06-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2013-08-05T16:00:00+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2013:1137"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch",
            "6Server-RHOSE-INFRA-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.src",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-debuginfo-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-devel-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-doc-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-irb-0:1.9.3.448-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-libs-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-ruby-tcltk-0:1.9.3.448-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-bigdecimal-0:1.1.0-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-io-console-0:0.3-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-json-0:1.5.5-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rake-0:0.9.2.2-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygem-rdoc-0:3.9.5-38.el6.x86_64",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygems-0:1.8.23-38.el6.noarch",
            "6Server-RHOSE-NODE-1.2:ruby193-rubygems-devel-0:1.8.23-38.el6.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "ruby: hostname check bypassing vulnerability in SSL client"
    }
  ]
}

cve-2013-4073

Vulnerability from cvelistv5

Published

2013-08-18 01:00

Modified

2024-08-06 16:30

Severity ?

Summary

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

References

▼	URL	Tags
	http://www.debian.org/security/2013/dsa-2738	vendor-advisory, x_refsource_DEBIAN
	http://www.ubuntu.com/usn/USN-1902-1	vendor-advisory, x_refsource_UBUNTU
	http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2013-1090.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2013-1103.html	vendor-advisory, x_refsource_REDHAT
	http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html	vendor-advisory, x_refsource_APPLE
	http://support.apple.com/kb/HT6150	x_refsource_CONFIRM
	https://puppet.com/security/cve/cve-2013-4073	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=979251	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2013-07/msg00042.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2013-1137.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-updates/2013-07/msg00044.html	vendor-advisory, x_refsource_SUSE
	http://www.debian.org/security/2013/dsa-2809	vendor-advisory, x_refsource_DEBIAN
	http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:30:49.912Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-2738",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2013/dsa-2738"
          },
          {
            "name": "USN-1902-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1902-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21"
          },
          {
            "name": "RHSA-2013:1090",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1090.html"
          },
          {
            "name": "RHSA-2013:1103",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1103.html"
          },
          {
            "name": "APPLE-SA-2013-10-22-3",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT6150"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/cve-2013-4073"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=979251"
          },
          {
            "name": "openSUSE-SU-2013:1181",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00042.html"
          },
          {
            "name": "RHSA-2013:1137",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-1137.html"
          },
          {
            "name": "openSUSE-SU-2013:1186",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00044.html"
          },
          {
            "name": "DSA-2809",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2013/dsa-2809"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-06-27T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a \u0027\\0\u0027 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-08T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "DSA-2738",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2013/dsa-2738"
        },
        {
          "name": "USN-1902-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1902-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21"
        },
        {
          "name": "RHSA-2013:1090",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1090.html"
        },
        {
          "name": "RHSA-2013:1103",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1103.html"
        },
        {
          "name": "APPLE-SA-2013-10-22-3",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT6150"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://puppet.com/security/cve/cve-2013-4073"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=979251"
        },
        {
          "name": "openSUSE-SU-2013:1181",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00042.html"
        },
        {
          "name": "RHSA-2013:1137",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-1137.html"
        },
        {
          "name": "openSUSE-SU-2013:1186",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00044.html"
        },
        {
          "name": "DSA-2809",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2013/dsa-2809"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-4073",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a \u0027\\0\u0027 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-2738",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2013/dsa-2738"
            },
            {
              "name": "USN-1902-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1902-1"
            },
            {
              "name": "http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel!",
              "refsource": "CONFIRM",
              "url": "http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel!"
            },
            {
              "name": "RHSA-2013:1090",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1090.html"
            },
            {
              "name": "RHSA-2013:1103",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1103.html"
            },
            {
              "name": "APPLE-SA-2013-10-22-3",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html"
            },
            {
              "name": "http://support.apple.com/kb/HT6150",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT6150"
            },
            {
              "name": "https://puppet.com/security/cve/cve-2013-4073",
              "refsource": "CONFIRM",
              "url": "https://puppet.com/security/cve/cve-2013-4073"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=979251",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=979251"
            },
            {
              "name": "openSUSE-SU-2013:1181",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00042.html"
            },
            {
              "name": "RHSA-2013:1137",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-1137.html"
            },
            {
              "name": "openSUSE-SU-2013:1186",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00044.html"
            },
            {
              "name": "DSA-2809",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2013/dsa-2809"
            },
            {
              "name": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/",
              "refsource": "CONFIRM",
              "url": "http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-4073",
    "datePublished": "2013-08-18T01:00:00",
    "dateReserved": "2013-06-09T00:00:00",
    "dateUpdated": "2024-08-06T16:30:49.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted