CVE-2025-46551
May 07, 2025
JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates, JRuby-OpenSSL does not verify that the hostname presented in the certificate matches the one the user tries to connect to. This means a man-in-the-middle could just present any valid cert for a completely different domain they own, and JRuby would accept the cert. Anybody using JRuby to make requests of external APIs, or scraping the web, that depends on https to connect securely. JRuby-OpenSSL version 0.15.4 contains a fix for the issue. This fix is included in JRuby versions 10.0.0.1 and 9.4.12.1.
Affected Packages
https://github.com/jruby/jruby-openssl.git (GITHUB):
Affected version(s) >=v0.12.1 <v0.15.4Fix Suggestion:
Update to version v0.15.4org.jruby:jruby (JAVA):
Affected version(s) =10.0.0.0 <10.0.0.1Fix Suggestion:
Update to version 10.0.0.1org.jruby:jruby (JAVA):
Affected version(s) >=9.3.4.0 <9.4.12.1Fix Suggestion:
Update to version 9.4.12.1jruby-openssl (RUBY):
Affected version(s) >=0.12.1 <0.15.4Fix Suggestion:
Update to version 0.15.4Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.7
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
POC
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE
Weakness Type (CWE)
EPSS
Base Score:
0.10
