VYPR
← All advisories
Critical severityNVD Advisory· Published Nov 16, 2018· Updated Aug 5, 2024

CVE-2018-16395

CVE-2018-16395

Description

An issue was discovered in the OpenSSL library in Ruby before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.2, and 2.6.x before 2.6.0-preview3. When two OpenSSL::X509::Name objects are compared using ==, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of == will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
opensslRubyGems
< 2.0.92.0.9
opensslRubyGems
>= 2.1.0, < 2.1.22.1.2

Affected products

29

Patches

Vulnerability mechanics

References

31

News mentions

0

No linked articles in our index yet.