Lucene search
Ubuntu.comUB:CVE-2015-3900HistoryJun 24, 2015 - 12:00 a.m.
CVE-2015-3900
2015-06-2400:00:00
ubuntu.com
ubuntu.com
9
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.008 Low
EPSS
Percentile
82.3%
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7
does not validate the hostname when fetching gems or making API requests,
which allows remote attackers to redirect requests to arbitrary domains via
a crafted DNS SRV record, aka a “DNS hijack attack.”
Bugs
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=790111>
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=790119>
Notes
| Author | Note |
|---|---|
| tyhicks | rubygems is for users of ruby1.8. ruby1.9.1 and jruby ship an embedded rubygems. |
| seth-arnold | I have doubts this patch actually addresses DNS hijacking adequately; this may properly restrict SRV records, but what verifies subsequent lookups to ensure the returned IPs aren’t under attacker control? Marking ‘low’ as a result. |
References
Related
cve
cve
CVE-2015-3900
2015-06-24 14:59:01
CVE-2015-4020
2015-08-25 17:59:01
fedora
fedora
[SECURITY] Fedora 21 Update: rubygems-2.2.5-100.fc21
2015-08-19 08:17:15
[SECURITY] Fedora 22 Update: rubygems-2.4.8-100.fc22
2015-08-11 02:06:59
[SECURITY] Fedora 23 Update: rubygems-2.4.8-100.fc23
2015-08-10 10:06:28
nessus
nessus
Fedora 23 : rubygems-2.4.8-100.fc23 (2015-12501)
2015-08-11 00:00:00
FreeBSD : rubygems -- request hijacking vulnerability (a0089e18-fc9e-11e4-bc58-001e67150279)
2015-05-18 00:00:00
Fedora 21 : rubygems-2.2.5-100.fc21 (2015-13157)
2015-08-20 00:00:00
osv
osv
RubyGems vulnerable to DNS hijack attack
2022-05-14 01:08:49
RubyGems Improper Input Validation vulnerability
2022-05-17 00:16:50
hackerone
hackerone
RubyGems: Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier
2015-05-06 00:00:00
RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
2017-04-02 17:31:05
openvas
openvas
Fedora Update for rubygems FEDORA-2015-13157
2015-08-20 00:00:00
Fedora Update for rubygems FEDORA-2015-12574
2015-08-11 00:00:00
Mageia: Security Advisory (MGASA-2015-0345)
2015-10-15 00:00:00
prion
prion
Design/Logic Flaw
2015-06-24 14:59:00
Design/Logic Flaw
2015-08-25 17:59:00
freebsd
freebsd
rubygems -- request hijacking vulnerability
2015-05-14 00:00:00
debiancve
debiancve
CVE-2015-3900
2015-06-24 14:59:01
CVE-2015-4020
2015-08-25 17:59:01
cvelist
cvelist
CVE-2015-3900
2015-06-24 14:00:00
CVE-2015-4020
2015-08-25 17:00:00
threatpost
threatpost
RubyGems Patches Serious Redirection Vulnerability
2015-06-23 09:55:51
github
github
RubyGems vulnerable to DNS hijack attack
2022-05-14 01:08:49
RubyGems Improper Input Validation vulnerability
2022-05-17 00:16:50
veracode
veracode
Man-in-the-Middle (MitM)
2019-01-15 09:07:12
redhat
redhat
(RHSA-2015:1657) Important: rh-ruby22-ruby security update
2015-08-24 00:00:00
mageia
mageia
Updated ruby-RubyGems packages fix security vulnerabilities
2015-09-08 20:55:59
nvd
nvd
CVE-2015-3900
2015-06-24 14:59:01
CVE-2015-4020
2015-08-25 17:59:01
rubygems
rubygems
amazon
amazon
ubuntucve
ubuntucve
CVE-2015-4020
2015-08-25 00:00:00
suse
suse
Security update for ruby2.1 (important)
2017-04-20 12:08:57
Security update for ruby2.1 (important)
2017-04-28 18:11:28
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.008 Low
EPSS
Percentile
82.3%
Related for UB:CVE-2015-3900