GitHub Advisoryadvisory · RubyGems

GHSA-7359-3c6r-hfc2 Improper Certificate Validation in oauth ruby gem

HIGH Published 2021-04-22 Modified 2023-01-24 Official page ↗
Aliases
CVE-2016-11086
Ecosystem
RubyGems
Packages
oauth
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2021-04-20

Affected packages

• RubyGems oauth: < 0.5.5 → fixed in 0.5.5

Description

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.

Related

Alias · CVE (1)

  • CVE-2016-11086 lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References