CVE-2007-5770

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-11-14 · updated 2026-06-16
Weakness: CWE-287

Description

The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.

Affected products

Ruby: 1.8.5, 1.8.6

References

http://docs.info.apple.com/article.html?artnum=307179
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
http://secunia.com/advisories/26985
http://secunia.com/advisories/27576
http://secunia.com/advisories/27673
http://secunia.com/advisories/27756
http://secunia.com/advisories/27764
http://secunia.com/advisories/27769
http://secunia.com/advisories/27818
http://secunia.com/advisories/28136
http://secunia.com/advisories/28645
http://secunia.com/advisories/29556

Get alerted when CVE-2007-5770 or the next vulnerability affects your stack