CVE-2007-5162 – Net: HTTP insufficient verification of SSL certificate

https://notcve.org/view.php?id=CVE-2007-5162

The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site. El método connect en lib/net/http.rb en las bibliotecas (1) Net::HTTP y (2) Net::HTTPS de Ruby 1.8.5 y 1.8.6 no verifica que el campo commonName (CN) en un certificado de servidor concuerde con el nombre de dominio de una petición HTTPS, lo cual facilita a atacantes remotos interceptar transmisiones SSL mediante un ataque de "hombre en medio" (man-in-the-middle) o sitio web falsificado. • http://secunia.com/advisories/26985 http://secunia.com/advisories/27044 http://secunia.com/advisories/27432 http://secunia.com/advisories/27576 http://secunia.com/advisories/27673 http://secunia.com/advisories/27756 http://secunia.com/advisories/27764 http://secunia.com/advisories/27769 http://secunia.com/advisories/27818 http://secunia.com/advisories/28645 http://secunia.com/advisories/29556 http://securityreason.com/securityalert/3180 http://svn.ruby-lang.org/cgi-bin/vi • CWE-287: Improper Authentication •