UpHeron
All vulnerabilities

Servers and applications

CVE-2013-4073

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate…

Severity
Medium 6.8
Published
18 Aug 2013
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
RubyServers and applications · cpe:a:ruby-lang:ruby
  • Version 2.0.0-p195
  • Version 2.0.0-p0
  • Version 2.0.0-rc2
  • Version 2.0.0-rc1
All 42 release lines
  • Version 1.8.6-26
  • Version 1.8.7-preview1
  • Version 1.8.7-preview2
  • Version 1.8.7-preview3
  • Version 1.8.7-preview4
  • Version 1.8.7
  • Version 1.8.7-p17
  • Version 1.8.7-p22
  • Version 1.8.7-p71
  • Version 1.8.7-p72
  • Version 1.8.7-p160
  • Version 1.8.7-p173
  • Version 1.8.7-p174
  • Version 1.8.7-p248
  • Version 1.8.7-p249
  • Version 1.8.7-p299
  • Version 1.8.7-p301
  • Version 1.8.7-p302
  • Version 1.8.7-p330
  • Version 1.8.7-p334
  • Version 1.8.7-p352
  • Version 1.8.7-p357
  • Version 1.8.7-p358
  • Version 1.8.7-p370
  • Version 1.8.7-p371
  • Version 1.8.7-p373
  • Version 1.9.3
  • Version 1.9.3-p0
  • Version 1.9.3-p125
  • Version 1.9.3-p194
  • Version 1.9.3-p286
  • Version 1.9.3-p383
  • Version 1.9.3-p385
  • Version 1.9.3-p392
  • Version 1.9.3-p426
  • Version 1.9.3-p429
  • Version 2.0.0-preview1
  • Version 2.0.0-preview2
  • Version 2.0.0-rc1
  • Version 2.0.0-rc2
  • Version 2.0.0-p0
  • Version 2.0.0-p195

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2013-4073
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2013-4073