CVE-2009-0642

Publication date 20 February 2009

Last updated 24 July 2024

ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
ruby1.8	11.10 oneiric	Not affected
	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Fixed 1.8.7.72-3ubuntu0.1
	8.10 intrepid	Fixed 1.8.7.72-1ubuntu0.2
	8.04 LTS hardy	Fixed 1.8.6.111-2ubuntu1.3
	7.10 gutsy	Ignored end of life, was needed
	6.06 LTS dapper	Fixed 1.8.4-1ubuntu1.7
ruby1.9	11.10 oneiric	Not in release
	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Fixed 1.9.0.2-9ubuntu1.1
	8.10 intrepid	Fixed 1.9.0.2-7ubuntu1.2
	8.04 LTS hardy	Ignored end of life
	7.10 gutsy	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
ruby1.8	Upstream: http://redmine.ruby-lang.org/repositories/revision/ruby-187?rev=22857 Vendor: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=18;filename=ruby1.8-1.8.7.72-3_1.8.7.72-3.1.patch;att=1;bug=517639
ruby1.9	Upstream: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=22440 Vendor: http://patch-tracking.debian.net/patch/series/view/ruby1.9/1.9.0.2-9.1/931_CVE-2009-0642

CVE-2009-0642

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references