| Package | Affected versions | Patched versions |
|---|---|---|
| http | ≥ 0.7.0, < 0.7.3< 0.6.4 | 0.7.30.6.4 |
| http.rb | ≤ 0.7.2 |
The Ruby http gem before 0.6.4 and 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free