Every CVE Search/ Get API key

CVE-2013-4073

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1...

6.8 MediumFix available

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploit likelihood

2.76%Up 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2013-4073
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
CVE-2013-4073
Updated
2026-11-02
EUVDEUVD-2013-4004 No score

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
EUVD-2013-4004
Updated
2026-11-03
GitHub AdvisoriesGHSA-3gpq-xx45-4rr9 No score

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1...

The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Record
GHSA-3gpq-xx45-4rr9
Updated
2026-11-02
OSVBELL-CVE-2013-4073 6.8

CVE-2013-4073 does not affect BellSoft software

Record
BELL-CVE-2013-4073
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
OSVMGASA-2013-0229 No score

Updated ruby packages fix CVE-2013-4073

A vulnerability in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority (CVE-2013-4073).

Record
MGASA-2013-0229
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ruby1.9.1
Debian:6.0
 before 1.9.2.0-2+deb6u1, plus listed versions
1.9.2.0-21.9.2.0-2+armhf
1.9.2.0-2+deb6u1
ruby1.9.1
Debian:7
 before 1.9.3.194-8.1+deb7u1, plus listed versions
1.9.3.194-8.1
1.9.3.194-8.1+deb7u1
ruby1.8
Debian:6.0
 before 1.8.7.302-2squeeze2, plus listed versions
1.8.7.302-21.8.7.302-2squeeze1
1.8.7.302-2squeeze2
ruby1.8
Debian:7
 before 1.8.7.358-7.1+deb7u1, plus listed versions
1.8.7.358-71.8.7.358-7.1
1.8.7.358-7.1+deb7u1
ruby
Mageia:2
 before 1.8.7.p358-1.3.mga2
1.8.7.p358-1.3.mga2
ruby
Mageia:3
 before 1.9.3.p448-1.mga3
1.9.3.p448-1.mga3
ruby-linecache19
Mageia:3
 before 0.5.13-5.1.mga3
0.5.13-5.1.mga3
ruby-ruby-debug-base19
Mageia:3
 before 0.11.26-5.1.mga3
0.11.26-5.1.mga3
ruby
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
Show 74 moreShow less
Affected packages
PackageAffectedFixed
ruby-devel
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-docs
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-irb
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-libs
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-mode
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-rdoc
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-ri
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby-tcltk
Red Hat:enterprise_linux:5::server
 before 0:1.8.5-31.el5_9
0:1.8.5-31.el5_9
ruby
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-devel
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-irb
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-libs
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-rdoc
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-docs
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-ri
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-static
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-tcltk
Red Hat:enterprise_linux:6::client
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-irb
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-libs
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-rdoc
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-docs
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-ri
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-tcltk
Red Hat:enterprise_linux:6::computenode
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-devel
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-irb
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-libs
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-rdoc
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-docs
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-ri
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-static
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-tcltk
Red Hat:enterprise_linux:6::server
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-irb
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-libs
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-rdoc
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-docs
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-ri
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby-tcltk
Red Hat:enterprise_linux:6::workstation
 before 0:1.8.7.352-12.el6_4
0:1.8.7.352-12.el6_4
ruby193-ruby
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-ruby-debuginfo
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-ruby-devel
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-ruby-doc
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-ruby-irb
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-ruby-libs
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-ruby-tcltk
Red Hat:openstack:3::el6
 before 0:1.9.3.429-34.2.el6ost
0:1.9.3.429-34.2.el6ost
ruby193-rubygem-bigdecimal
Red Hat:openstack:3::el6
 before 0:1.1.0-34.2.el6ost
0:1.1.0-34.2.el6ost
ruby193-rubygem-io-console
Red Hat:openstack:3::el6
 before 0:0.3-34.2.el6ost
0:0.3-34.2.el6ost
ruby193-rubygem-json
Red Hat:openstack:3::el6
 before 0:1.5.5-34.2.el6ost
0:1.5.5-34.2.el6ost
ruby193-rubygem-minitest
Red Hat:openstack:3::el6
 before 0:2.5.1-34.2.el6ost
0:2.5.1-34.2.el6ost
ruby193-rubygem-rake
Red Hat:openstack:3::el6
 before 0:0.9.2.2-34.2.el6ost
0:0.9.2.2-34.2.el6ost
ruby193-ruby
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-ruby-debuginfo
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-ruby-devel
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-ruby-doc
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-ruby-irb
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-ruby-libs
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-ruby-tcltk
Red Hat:openshift:1.2::el6
 before 0:1.9.3.448-38.el6
0:1.9.3.448-38.el6
ruby193-rubygem-bigdecimal
Red Hat:openshift:1.2::el6
 before 0:1.1.0-38.el6
0:1.1.0-38.el6
ruby193-rubygem-io-console
Red Hat:openshift:1.2::el6
 before 0:0.3-38.el6
0:0.3-38.el6
ruby193-rubygem-json
Red Hat:openshift:1.2::el6
 before 0:1.5.5-38.el6
0:1.5.5-38.el6
ruby193-rubygem-rake
Red Hat:openshift:1.2::el6
 before 0:0.9.2.2-38.el6
0:0.9.2.2-38.el6
ruby193-rubygem-rdoc
Red Hat:openshift:1.2::el6
 before 0:3.9.5-38.el6
0:3.9.5-38.el6
ruby193-rubygems
Red Hat:openshift:1.2::el6
 before 0:1.8.23-38.el6
0:1.8.23-38.el6
ruby193-rubygems-devel
Red Hat:openshift:1.2::el6
 before 0:1.8.23-38.el6
0:1.8.23-38.el6

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4073 is a medium vulnerability (CVSS 6.8) in Ruby-lang Ruby, published July 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.76%, the 86th percentile. Fixed in ruby1.9.1 1.9.2.0-2+deb6u1.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open