CVE-2009-0642: ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_ve...

Security readout for executives and security teams

This is a certificate trust bug in old Ruby runtimes. A system using Ruby's OpenSSL OCSP checks could incorrectly accept a bad certificate, potentially including a revoked one. The business risk is highest where legacy Ruby applications make security decisions from certificate validity. Likely exposure is limited to Ruby 1.8 or 1.9 deployments using Ruby OpenSSL OCSP certificate verification. Modern exposure would mainly come from legacy applications, old operating system packages, embedded runtimes, or appliances. The source bundle does not identify newer Ruby versions as affected. Handle during legacy runtime remediation, with higher priority for systems that validate external certificates or protect regulated data. No active exploitation is cited, but accepting revoked or invalid certificates can undermine authentication and encrypted-channel trust. Mitigation focus: Identify and retire Ruby 1.8 and 1.9 runtimes where possible.; Apply relevant vendor security updates from Red Hat, Ubuntu, Mandriva, or Ruby guidance.; Review legacy applications that rely on Ruby OpenSSL OCSP verification..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.