This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2015-1828 →

DEBIAN-CVE-2015-1828

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a...

Original description

The description as published by the source.

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ruby-http

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]

Debian:13 ruby-http

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]

Debian:14 ruby-http

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]

References

advisory security-tracker.debian.org