Executive brief
The Ruby 'http' library, used by developers to make web requests, fails to properly verify the identity of servers when using encrypted SSL connections. This flaw allows a well-positioned attacker to intercept communications, potentially exposing sensitive data like login credentials or private API keys. Organizations using affected versions of this library are at risk of data theft during network-based attacks.
Technical details
The Ruby 'http' gem (also known as httprb) prior to versions 0.6.4 and 0.7.3 contains a flaw where it does not perform hostname verification during SSL/TLS handshakes. This vulnerability class (CWE-200/CWE-297) occurs because the library fails to ensure that the certificate presented by the server matches the requested hostname. A remote attacker capable of performing a Man-in-the-Middle (MitM) attack can present a spoofed certificate to intercept encrypted traffic. This allows for the disclosure of sensitive information transmitted over the connection. The issue is resolved in versions 0.6.4 and 0.7.3.
Affected products
- httprb http < 0.6.4, >= 0.7.0, < 0.7.3
Timeline
- 2015-04-10: disclosed: Initial discovery/report date based on CVE year and related issues
- 2017-10-06: advisory: NVD published date
- 2018-03-13: advisory: GitHub Advisory published