{"id":"CVE-2015-1828","aliases":["DEBIAN-CVE-2015-1828","EUVD-2018-0172","GHSA-6wpv-cj6x-v3jw","UBUNTU-CVE-2015-1828"],"status":"published","title":"http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01521,"percentile":0.74758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-10-06T22:00:00Z","modified":"2026-09-09T07:00:34Z","fixes":[{"ecosystem":"RubyGems","package":"http","fixed_in":["0.7.3","0.6.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-http","fixed_in":["1.0.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-http","fixed_in":["1.0.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-http","fixed_in":["1.0.2-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.7.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"fixed":"0.7.3"}]}],"versions":["0.7.0","0.7.1","0.7.2"]},{"source":"osv","ecosystem":"RubyGems","package":"http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.4"}]}],"versions":["0.0.0","0.0.1","0.0.2","0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","0.5.0.pre","0.5.0.pre2","0.5.1","0.6.0","0.6.0.pre","0.6.1","0.6.2","0.6.3"]}],"products":[{"vendor":"http.rb_project","product":"http.rb"}],"references":[{"url":"https://rubysec.com/advisories/http-CVE-2015-1828","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/ruby/openssl/issues/8","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"https://groups.google.com/forum/#%21topic/httprb/jkb4oxwZjkU","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1828","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU","tags":["web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/http/CVE-2015-1828.yml","tags":["web"]},{"url":"https://my.diffend.io/gems/http/0.6.3/0.6.4","tags":["web"]},{"url":"https://my.diffend.io/gems/http/0.7.2/0.7.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6wpv-cj6x-v3jw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1828","tags":["advisory"]},{"url":"https://github.com/httprb/http","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-1828","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1828","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1828","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2017-10-06T22:00:00Z","modified":"2024-08-06T04:54:16.319Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2018-0172","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2017-10-06T22:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:13.664628Z"}],"ghsa":[{"id":"GHSA-6wpv-cj6x-v3jw","title":"http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","description":"The Ruby http gem before 0.6.4 and 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2018-03-13T16:15:57Z","modified":"2026-04-17T19:01:03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:39:55.105822Z"}],"nvd":[{"id":"CVE-2015-1828","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2017-10-06T22:29:00.337Z","modified":"2026-06-17T00:23:04.49Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:19.244941Z"}],"osv":[{"id":"CVE-2015-1828","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2017-10-06T22:29:00Z","modified":"2026-04-10T03:45:09.03435Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1828","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2017-10-06T22:29:00.337Z","modified":"2026-09-09T07:00:34.697230583Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-6wpv-cj6x-v3jw","title":"http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","description":"The Ruby http gem before 0.6.4 and 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"published","published":"2018-03-13T16:15:57Z","modified":"2026-04-17T19:16:39.30579Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"UBUNTU-CVE-2015-1828","description":"The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.","status":"withdrawn","published":"2017-10-06T22:29:00Z","modified":"2025-07-16T08:11:25.347319Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.045446Z"}]}}