Description

ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.

Remediation

References

CVE-2009-0642

Related Vulnerabilities

PHP Out-of-bounds Read Vulnerability (CVE-2019-9021)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-0372)

TCExam Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-5750)

Ruby Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2013-4164)

WordPress Plugin ARMember-Content Restriction & Membership Security Bypass (1.4)

Severity

Medium

Classification

CVE-2009-0642 CWE-287

Tags

Missing Update Known Vulnerabilities