CVE-2017-17718

The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
VendorProductVersion
net-ldap_projectnet-ldap
0.0.5
net-ldap_projectnet-ldap
0.1.0
net-ldap_projectnet-ldap
0.1.1
net-ldap_projectnet-ldap
0.2
net-ldap_projectnet-ldap
0.2.1
net-ldap_projectnet-ldap
0.2.2
net-ldap_projectnet-ldap
0.3.0
net-ldap_projectnet-ldap
0.3.1
net-ldap_projectnet-ldap
0.5.1
net-ldap_projectnet-ldap
0.6.0
net-ldap_projectnet-ldap
0.6.1
net-ldap_projectnet-ldap
0.7.0
net-ldap_projectnet-ldap
0.8.0
net-ldap_projectnet-ldap
0.9.0
net-ldap_projectnet-ldap
0.10.0
net-ldap_projectnet-ldap
0.10.1
net-ldap_projectnet-ldap
0.11
net-ldap_projectnet-ldap
0.12.0
net-ldap_projectnet-ldap
0.12.1
net-ldap_projectnet-ldap
0.13.0
net-ldap_projectnet-ldap
0.14.0
net-ldap_projectnet-ldap
0.15.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ruby-net-ldap
bullseye
0.16.1-1
fixed
stretch
no-dsa
jessie
not-affected
wheezy
ignored
bookworm
0.17.0-1
fixed
sid
0.17.1-2
fixed
trixie
0.17.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ruby-net-ldap
cosmic
not-affected
bionic
not-affected
artful
ignored
zesty
ignored
xenial
not-affected
trusty
dne
Common Weakness Enumeration
References
http://openwall.com/lists/oss-security/2017/12/17/10
https://github.com/ruby-ldap/ruby-net-ldap/issues/258
https://github.com/ruby-ldap/ruby-net-ldap/pull/279
http://openwall.com/lists/oss-security/2017/12/17/10
https://github.com/ruby-ldap/ruby-net-ldap/issues/258
https://github.com/ruby-ldap/ruby-net-ldap/pull/279