CVE-2018-16395
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 10.7%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 10.71% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- ruby-lang/openssl · ruby-lang/ruby · canonical/ubuntu linux · debian/debian linux · redhat/enterprise linux
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.htmlMailing List, Third Party Advisory
- http://www.securitytracker.com/id/1042105Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:3729Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3730Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3731Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3738Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1948Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2565
- https://hackerone.com/reports/387250Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/10/msg00020.htmlThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190221-0002/Third Party Advisory
- https://usn.ubuntu.com/3808-1/Third Party Advisory
- https://www.debian.org/security/2018/dsa-4332Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.ruby-lang.org/en/news/2018/10/17/openssl-x509-name-equality-check-does-not-work-correctly-cve-2018-16395/Mitigation, Vendor Advisory
- https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-3-8-released/Release Notes, Vendor Advisory
- https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-4-5-released/Release Notes, Vendor Advisory
- https://www.ruby-lang.org/en/news/2018/10/17/ruby-2-5-2-released/Release Notes, Vendor Advisory
- https://www.ruby-lang.org/en/news/2018/11/06/ruby-2-6-0-preview3-released/Release Notes, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.htmlMailing List, Third Party Advisory
- http://www.securitytracker.com/id/1042105Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:3729Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3730Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3731Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3738Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1948Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2565
- https://hackerone.com/reports/387250Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/10/msg00020.htmlThird Party Advisory
- https://security.netapp.com/advisory/ntap-20190221-0002/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.