What’s Vulnerable › Vulnerabilities

CVE-2015-1855

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-29 · updated 2026-06-17
• Weakness: CWE-20

Description

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

Affected products

• Debian Linux: 7.0, 8.0, 9.0
• Puppet Agent: 1.0.0
• Puppet Enterprise: from 3.0.0 before 3.8.0 — fixed in 3.8.0
• Ruby: from 2.1.0 before 2.1.6; from 2.2.0 before 2.2.2; 2.0.0, 2.0.0-p0, 2.0.0-p195, 2.0.0-p247, 2.0.0-p353, 2.0.0-p451 (+5) — fixed in 2.1.6, 2.2.2
• ruby-lang Trunk: before 50292 — fixed in 50292

How to fix

Upgrade to a fixed version: Puppet Enterprise 3.8.0; Ruby 2.1.6, 2.2.2; ruby-lang Trunk 50292. Check the vendor advisory for mitigations.

References

• http://www.debian.org/security/2015/dsa-3245
• http://www.debian.org/security/2015/dsa-3246
• http://www.debian.org/security/2015/dsa-3247
• https://bugs.ruby-lang.org/issues/9644
• https://puppetlabs.com/security/cve/cve-2015-1855
• https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/
• http://www.debian.org/security/2015/dsa-3245
• http://www.debian.org/security/2015/dsa-3246
• http://www.debian.org/security/2015/dsa-3247
• https://bugs.ruby-lang.org/issues/9644
• https://puppetlabs.com/security/cve/cve-2015-1855
• https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/

Get alerted when CVE-2015-1855 or the next vulnerability affects your stack