NVD

Id
39753  
Name
CVE-2013-4073  
Description
The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a "" character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-08-17  
Modified Date
2014-04-01  
Seq
2013-4073  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
202146 39753 CVE-2013-4073 http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel!  View
202147 39753 CVE-2013-4073 APPLE-SA-2013-10-22-3  View
202148 39753 CVE-2013-4073 openSUSE-SU-2013:1181  View
202149 39753 CVE-2013-4073 openSUSE-SU-2013:1186  View
202150 39753 CVE-2013-4073 RHSA-2013:1090  View
202151 39753 CVE-2013-4073 RHSA-2013:1103  View
202152 39753 CVE-2013-4073 RHSA-2013:1137  View
202153 39753 CVE-2013-4073 http://support.apple.com/kb/HT6150  View
202154 39753 CVE-2013-4073 DSA-2738  View
202155 39753 CVE-2013-4073 DSA-2809  View
202156 39753 CVE-2013-4073 http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/  View
202157 39753 CVE-2013-4073 USN-1902-1  View
202158 39753 CVE-2013-4073 https://bugzilla.redhat.com/show_bug.cgi?id=979251  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
22204 JVNDB-2013-003779 Ruby の lib/openssl/ssl.rb における任意の SSL サーバになりすまされる脆弱性 Ruby の lib/openssl/ssl.rb の OpenSSL::SSL.verify_certificate_identity 関数は、X.509 証明書の Subject Alternative Name フィールド内のドメイン名に含まれる "" 文字を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2013-4073 64015 CVE-2013-4073 39753 6.8 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003779.html 2013-06-27 2015-08-10 View