-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stems from improper SSL certificate validation when using the 'server_ca_cert' setting. The GitHub PR #449 shows the fix occurred in transport/connection.rb where SSL configuration is handled. The critical issue was that specifying a CA certificate didn't enforce proper verification due to missing verify_mode configuration. The #start_ssl method (or equivalent SSL setup routine) in this file would be responsible for configuring OpenSSL parameters, and prior to 2.9.0, failed to set verify_mode to VERIFY_PEER when a CA cert was provided, making MITM attacks possible. This matches both the CWE-295 description and the patch's nature of adding proper verification flags.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| elastic-apm | rubygems | < 2.9.0 | 2.9.0 |
Ongoing coverage of React2Shell