http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor · CVE-2015-1828 · GitHub Advisory Database · GitHub

http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Moderate severity GitHub Reviewed Published Mar 13, 2018 to the GitHub Advisory Database • Updated Aug 29, 2023

Package

http (RubyGems)

Affected versions

< 0.7.3

Patched versions

0.7.3

Description

The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.

References

Published to the GitHub Advisory Database Mar 13, 2018

Reviewed Jun 16, 2020

Last updated Aug 29, 2023

Severity

Moderate

5.9

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N