VDB

GHSA-72qj-48g4-5xgx

GHSA-72qj-48g4-5xgx PUBLISHED CVSS 5.699999809265137 MEDIUM

JRuby-OpenSSL has hostname verification disabled by default

Record from GitHub Advisory Database · Published May 7, 2025

jruby-openssl is fixed in 0.15.4 (Maven Central)

JRuby-OpenSSL has hostname verification disabled by default

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
rubygems:jruby-opensslMaven Central0.15.4
org.jruby:jrubyMaven Central10.0.0.1, 9.4.12.1
jruby-opensslRubyGems0.15.4
logstash-8.19Chainguard8.19.19-r0
elasticsearch-8.17Chainguard8.17.10-r13

Risk scores

CVSS 4.0
5.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Affected products

VendorProductVersions
Mavenorg.jruby:jruby9.3.4.0, 10.0.0.0
chainguardlogstash-8.190
Mavenrubygems:jruby-openssl0.12.1
RubyGemsjruby-openssl0.12.1
chainguardelasticsearch-8.170

Timeline

  • May 7, 2025 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-72qj-48g4-5xgx
vulnetix vdb fixes GHSA-72qj-48g4-5xgx

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-72qj-48g4-5xgx/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›