# OpenSSL::X509::Name Equality Check Does Not Work, Patch included

OpenSSL::X509::Name#== in Ruby's openssl ext returned true for unequal names due to a bad comparison bound, enabling certificate name-validation bypass.

- Payout: hidden
- Severity: medium
- Program: Ruby
- Found by: tylereckstein
- Disclosed: 2018-10-19
- CVE: CVE-2018-16395
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/387250
- Library page: https://bugbountylibrary.com/r/h1%3A387250
- Tags: area:oss domain:oss impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:auth-bypass vuln:crypto

**Target:** Ruby openssl extension (ossl_x509name_cmp) / X.509 name comparison
**Root cause:** ossl_x509name_cmp0 returns the raw strcmp-style result, but the wrapper only mapped result > 1 to 1, so any positive result of exactly 1 (e.g. one-char-longer or one-less-char difference) fell through to return 0 (equal).
**Steps:**
1. Create `a = OpenSSL::X509::Name.new([["CN", "www.example.com"]])` and `b = OpenSSL::X509::Name.new([["CN", "www.example.co"]])`.
2. Compare `a == b` -> returns true though names differ.
3. Also `c = OpenSSL::X509::Name.new([["CN", "www.exbmple.com"]])`; `c == a` -> true (asymmetric).
4. Fix: change `if (result > 1)` to `if (result > 0)` in ossl_x509name_cmp.
**How found:** Researcher tested X509::Name equality in irb with names differing by a trailing character and by a one-less character, noticed asymmetric/incorrect true results, then traced to ossl_x509name_cmp's `result > 1` bound.
**Exploitation:** An attacker crafts a certificate whose subject/issuer name differs by one trailing character or one character one-less in the same position; during certificate validation the name comparison returns equal, so the illegitimate cert may be accepted as legitimate for signing/encryption.
**Insight:** When a C comparator returns strcmp-style values, check the wrapper's normalization bounds: mapping only `>1` to 1 silently treats a result of exactly 1 as equality. Test equality both directions with off-by-one-length and off-by-one-character names.