UpHeron
All vulnerabilities

Servers and applications

CVE-2015-1855

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

Severity
Medium 5.9
Published
29 Nov 2019
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
2.1.6, 2.2.2
Sources
NVD

Affected software

SoftwareAffected versions
RubyServers and applications · cpe:a:ruby-lang:ruby
  • From 2.2.0 before 2.2.2
  • From 2.1.0 before 2.1.6
  • Version 2.0.0-p643
  • Version 2.0.0-p598
All 13 release lines
  • Version 2.0.0
  • Version 2.0.0-p0
  • Version 2.0.0-p195
  • Version 2.0.0-p247
  • Version 2.0.0-p353
  • Version 2.0.0-p451
  • Version 2.0.0-p481
  • Version 2.0.0-p576
  • Version 2.0.0-p594
  • Version 2.0.0-p598
  • Version 2.0.0-p643
  • From 2.1.0 before 2.1.6
  • From 2.2.0 before 2.2.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-1855
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-1855