Insecure digital certificates In jruby-openssl
Description
jruby-openssl gem for JRuby fails to do proper certificate validation A security problem involving peer certificate verification was found where failed verification silently did nothing, making affected applications vulnerable to attackers. Attackers could lead a client application to believe that a secure connection to a rogue SSL server is legitimate. Attackers could also penetrate client-validated SSL server applications with a dummy certificate.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rubygems | 0.6 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.