GCVE - cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ruby-lang:ruby:1.8.7:p22:*:*:*:*:*:*

part: a version: 1.8.7 update: p22

Vendor	Ruby Lang (`5813a634-c286-5f1d-90d5-a1a352f78d39`)
Product	Ruby (`48f7c14c-c576-5b15-be87-22eeb9add91e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/ruby/ruby`	purl2cpe	2026-06-01 10:11:45.541284
`pkg:ruby-lang/ruby`	purl2cpe	2026-06-01 10:11:45.541286

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4073`	vulnerable	2026-06-08 05:04:33.736752	Details available The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Published: 2013-08-18T01:00:00.000Z Updated: 2024-08-06T16:30:49.912Z Open on db.gcve.eu Reference links http://www.debian.org/security/2013/dsa-2738 http://www.ubuntu.com/usn/USN-1902-1 http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21 http://rhn.redhat.com/errata/RHSA-2013-1090.html http://rhn.redhat.com/errata/RHSA-2013-1103.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-4466`	vulnerable	2026-06-08 05:02:17.728281	Details available Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005. Published: 2013-04-25T23:00:00.000Z Updated: 2024-08-06T20:35:09.685Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2012/10/02/4 http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 http://www.openwall.com/lists/oss-security/2012/10/03/9 https://bugzilla.redhat.com/show_bug.cgi?id=862614 http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2705`	vulnerable	2026-06-08 04:58:08.491213	Details available The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID. Published: 2011-08-05T21:00:00.000Z Updated: 2024-08-06T23:08:23.972Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2011/07/12/14 http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ https://bugzilla.redhat.com/show_bug.cgi?id=722415 http://www.openwall.com/lists/oss-security/2011/07/20/16 http://www.redhat.com/support/errata/RHSA-2011-1581.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2686`	vulnerable	2026-06-08 04:58:08.393445	Details available Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development. Published: 2011-08-05T21:00:00.000Z Updated: 2024-08-06T23:08:23.714Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2011/07/12/14 http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ https://bugzilla.redhat.com/show_bug.cgi?id=722415 http://www.openwall.com/lists/oss-security/2011/07/20/16 http://redmine.ruby-lang.org/issues/show/4338	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3905`	vulnerable	2026-06-08 04:50:37.143743	Details available resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. Published: 2008-09-04T17:00:00.000Z Updated: 2024-08-07T09:53:00.497Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2008/09/04/9 http://secunia.com/advisories/31430 https://usn.ubuntu.com/651-1/ http://www.securityfocus.com/bid/31699 http://www.debian.org/security/2008/dsa-1652	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3790`	vulnerable	2026-06-08 04:50:36.357071	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3657`	vulnerable	2026-06-08 04:50:35.856417	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3656`	vulnerable	2026-06-08 04:50:35.854947	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3655`	vulnerable	2026-06-08 04:50:35.853374	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3443`	vulnerable	2026-06-08 04:50:34.740623	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.