CVE-2015-1855
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2015
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Ruby
- Vendor
- Ruby
- Product
- Ruby
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| before 2.0.0 patchlevel 645 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 2.1.x before 2.1.6 | affected | Unavailable | Unavailable | Unavailable | None listed |
| and 2.2.x before 2.2.2 | affected | Unavailable | Unavailable | Unavailable | None listed |