OpenSSL Library Vulnerability in Ruby
Summary
CVE-2018-16395: An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. Affects ruby across 3 version ranges.
< 2.5.2-r0
< 08e12dd9302c1fd517c642bdd7d274e64b354c53
< faba7187c5e659d7a6da67ec844c4989fc74a8d5
Fixed in 2.5.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenSSL library is a widely used open-source cryptographic library that provides support for secure communications and data encryption. Ruby is a dynamic, open-source programming language that is popular for web development and scripting. The Ruby OpenSSL library is used for SSL/TLS functionality in Ruby applications. This vulnerability affects versions of Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3.
Vulnerability Detail
The vulnerability, identified as CVE-2018-16395, arises from a flaw in the OpenSSL library used by Ruby. When comparing two OpenSSL::X509::Name objects using the '==' operator, non-equal objects may incorrectly return true under specific conditions. This can be exploited to create a malicious certificate that may be accepted as legitimate, leading to potential security issues in signing or encryption operations. The vulnerability has a CVSS score of 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
2.5.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating Ruby to a patched version.
Conclusion
The OpenSSL library vulnerability in Ruby poses a critical security risk, allowing for the creation of illegitimate certificates. To mitigate this risk, it is crucial to update Ruby to version 2.5.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ruby →
FAQ
The vulnerability allows for the creation of illegitimate certificates that may be accepted as legitimate. This can lead to potential security breaches in signing or encryption operations.
Versions of Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3 are affected.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
No, there is no known workaround. It is necessary to update Ruby to a patched version.
Users should consult the official Ruby documentation or their package manager for instructions on updating Ruby to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
