Lucene search
AmazonALAS-2012-079HistoryMay 21, 2012 - 4:48 p.m.
Medium: rubygems
2012-05-2116:48:00
alas.aws.amazon.com
22
CVSS2
5.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
EPSS
0.004
Percentile
74.0%
Issue Overview:
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Affected Packages:
rubygems
Issue Correction:
Run yum update rubygems to update your system.
New Packages:
noarch:
rubygems-devel-1.8.11-3.1.amzn1.noarch
rubygems-1.8.11-3.1.amzn1.noarch
src:
rubygems-1.8.11-3.1.amzn1.src
Additional References
Red Hat: CVE-2012-2125
Mitre: CVE-2012-2125
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | noarch | rubygems-devel | < 1.8.11-3.1.amzn1 | rubygems-devel-1.8.11-3.1.amzn1.noarch.rpm |
| Amazon Linux | 1 | noarch | rubygems | < 1.8.11-3.1.amzn1 | rubygems-1.8.11-3.1.amzn1.noarch.rpm |
Related
debiancve
debiancve
CVE-2012-2125
2013-10-01 17:55:03
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2012-79)
2015-09-08 00:00:00
Fedora Update for rubygems FEDORA-2012-6409
2012-05-04 00:00:00
Ubuntu: Security Advisory (USN-1582-1)
2012-09-27 00:00:00
veracode
veracode
Man-in-the-Middle (MitM)
2019-01-15 08:53:54
Man-in-the-Middle (MitM)
2019-05-02 04:48:42
github
github
RubyGems HTTPS to HTTP redirect
2022-05-17 04:54:56
cve
cve
CVE-2012-2125
2013-10-01 17:55:03
nvd
nvd
CVE-2012-2125
2013-10-01 17:55:03
ubuntucve
ubuntucve
CVE-2012-2125
2012-04-20 00:00:00
osv
osv
RubyGems HTTPS to HTTP redirect
2022-05-17 04:54:56
cvelist
cvelist
CVE-2012-2125
2013-10-01 17:00:00
nessus
nessus
Amazon Linux AMI : rubygems (ALAS-2012-79)
2013-09-04 00:00:00
Fedora 15 : rubygems-1.7.2-5.fc15 (2012-6414)
2012-05-01 00:00:00
Oracle Solaris Third-Party Patch Update : rubygems (cve_2012_2125_https_to)
2015-01-19 00:00:00
prion
prion
Design/Logic Flaw
2013-10-01 17:55:00
fedora
fedora
[SECURITY] Fedora 16 Update: rubygems-1.8.11-3.fc16.1
2012-05-01 00:52:45
[SECURITY] Fedora 15 Update: rubygems-1.7.2-5.fc15
2012-05-01 00:52:30
[SECURITY] Fedora 17 Update: rubygems-1.8.23-20.fc17
2012-05-02 04:45:55
rubygems
rubygems
CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23
2012-09-24 20:00:00
CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23
2012-04-19 20:00:00
securityvulns
securityvulns
RubyGems https vulnerabilities
2012-10-04 00:00:00
[USN-1582-1] RubyGems vulnerabilities
2012-10-04 00:00:00
ubuntu
ubuntu
RubyGems vulnerabilities
2012-09-26 00:00:00
Ruby vulnerabilities
2012-09-26 00:00:00
redhat
redhat
(RHSA-2013:1203) Moderate: rubygems security update
2013-09-04 00:00:00
(RHSA-2013:1441) Moderate: rubygems security update
2013-10-17 00:00:00
(RHSA-2013:1852) Moderate: Red Hat Enterprise MRG Grid 2.4 security update
2013-12-17 00:00:00
centos
centos
rubygems security update
2013-10-18 12:42:23
oraclelinux
oraclelinux
rubygems security update
2013-10-17 00:00:00
CVSS2
5.8
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
EPSS
0.004
Percentile
74.0%
Related for ALAS-2012-079