RubyGems/http CVE-2015-1828: medium 5.9, EPSS 1.52%
http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Action: Upgrade http to 0.6.4 or later.
bundle update httpAffected
| introduced | fixed | last affected |
|---|---|---|
| 0.7.0 | 0.7.3 | - |
| 0 | 0.6.4 | - |
Fixed versions
| 0.7.3 | 0.6.4 |
Sources
- osv: GHSA-6wpv-cj6x-v3jw
- https://nvd.nist.gov/vuln/detail/CVE-2015-1828
- https://github.com/ruby/openssl/issues/8
- https://github.com/httprb/http
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/http/CVE-2015-1828.yml
- https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU
- https://my.diffend.io/gems/http/0.6.3/0.6.4
- https://my.diffend.io/gems/http/0.7.2/0.7.3
- https://rubysec.com/advisories/http-CVE-2015-1828
CVE-2015-1828 · published · modified · JSON