RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking

RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
that is triggered when handling hostnames in SRV records. With a specially
crafted response, a context-dependent attacker may conduct DNS hijacking
attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900,
which allowed redirection to an arbitrary gem server in any security domain.