GHSA-mmrq-6999-72v8

Ruby Openssl Allows Incorrect Value Comparison

En bref

Publiée
Mise à jour
CVE
CVE-2018-16395
CVSS_V3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in the OpenSSL library in Ruby when two `OpenSSL::X509::Name` objects are compared using `==`, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of `==` will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.

Paquets affectés

PaquetVersions
RubyGems · opensslintroduced 0, fixed 2.0.9
RubyGems · opensslintroduced 2.1.0, fixed 2.1.2

Références

Sources

SourceLicence
OSV.devCC-BY 4.0 — GitHub Advisory Database