CVE-2015-1855

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

• CWE-20

• http://www.debian.org/security/2015/dsa-3245Third Party Advisory
• http://www.debian.org/security/2015/dsa-3246Third Party Advisory
• http://www.debian.org/security/2015/dsa-3247Third Party Advisory
• https://bugs.ruby-lang.org/issues/9644Third Party Advisory
• https://puppetlabs.com/security/cve/cve-2015-1855Third Party Advisory
• https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/Vendor Advisory
• http://www.debian.org/security/2015/dsa-3245Third Party Advisory
• http://www.debian.org/security/2015/dsa-3246Third Party Advisory
• http://www.debian.org/security/2015/dsa-3247Third Party Advisory
• https://bugs.ruby-lang.org/issues/9644Third Party Advisory
• https://puppetlabs.com/security/cve/cve-2015-1855Third Party Advisory
• https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/Vendor Advisory

Published

Nov 29, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1849AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Applicat…
• CVE-2015-1850Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-1851OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before…
• CVE-2015-1852The s3_token middleware in OpenStack keystonemiddleware befo…
• CVE-2015-1853chrony before 1.31.1 does not properly protect state variabl…6.5
• CVE-2015-1854389 Directory Server before 1.3.3.10 allows attackers to byp…
• CVE-2015-1856OpenStack Object Storage (Swift) before 2.3.0, when allow_ve…
• CVE-2015-1857The odl-mdsal-apidocs feature in OpenDaylight Helium allow r…5.3
• CVE-2015-1858Multiple buffer overflows in gui/image/qbmphandler.cpp in th…
• CVE-2015-1859Multiple buffer overflows in plugins/imageformats/ico/qicoha…
• CVE-2015-1860Multiple buffer overflows in gui/image/qgifhandler.cpp in th…
• CVE-2015-1861Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…