CVE-2007-5162

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-01 · updated 2026-06-16
Weakness: CWE-287

Description

The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

Affected products

Ruby: 1.8.5, 1.8.6

References

http://secunia.com/advisories/26985
http://secunia.com/advisories/27044
http://secunia.com/advisories/27432
http://secunia.com/advisories/27576
http://secunia.com/advisories/27673
http://secunia.com/advisories/27756
http://secunia.com/advisories/27764
http://secunia.com/advisories/27769
http://secunia.com/advisories/27818
http://secunia.com/advisories/28645
http://secunia.com/advisories/29556
http://securityreason.com/securityalert/3180

Get alerted when CVE-2007-5162 or the next vulnerability affects your stack