CVE-2013-4073

CVE-2013-4073 is a critical vulnerability affecting Ruby versions 1.8, 1.9, and 2.0. It stems from a flaw in the OpenSSL::SSL.verify_certificate_identity function, which improperly handles null characters in X.509 certificate Subject Alternative Name fields. This allows man-in-the-middle attackers to spoof SSL servers using specially crafted certificates from legitimate Certificate Authorities. The vulnerability carries a CVSS score of 6.8, indicating a medium severity. It can be exploited remotely with medium attack complexity, potentially leading to partial compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal.