Improper Access Control

2019-05-1602:16:34

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.008 Low

EPSS

Percentile

81.1%

JSON

RubyGems is vulnerable to improper access control. A remote attacker with the ability to manipulate DNS responses could direct the gem command towards a different domain due to unsanitize DNS responses when requesting the hostname of the rubygems server for a domain resulting in DNS hijacking vulnerability.

CPENameOperatorVersion
rh-ruby24-rubyeq2.4.0__75.el7
rh-ruby24-rubyeq2.4.0__75.el6
rh-ruby22-rubyeq2.2.2__11.el6
rh-ruby22-rubyeq2.2.2__15.el6
rh-ruby22-rubyeq2.2.2__16.el6
rh-ruby22-rubyeq2.2.2__16.el7
rh-ruby22-rubyeq2.2.2__12.el6
rh-ruby23-rubyeq2.3.1__64.el7
rh-ruby23-rubyeq2.3.1__64.el6
ruby:3.3eq2.2.4-r0

Name	Operator	Version
rh-ruby24-ruby	eq	2.4.0__75.el7
rh-ruby24-ruby	eq	2.4.0__75.el6
rh-ruby22-ruby	eq	2.2.2__11.el6
rh-ruby22-ruby	eq	2.2.2__15.el6
rh-ruby22-ruby	eq	2.2.2__16.el6
rh-ruby22-ruby	eq	2.2.2__16.el7
rh-ruby22-ruby	eq	2.2.2__12.el6
rh-ruby23-ruby	eq	2.3.1__64.el7
rh-ruby23-ruby	eq	2.3.1__64.el6
ruby:3.3	eq	2.2.4-r0