CVE-2015-3900

2015-06-2414:59:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.008 Low

EPSS

Percentile

81.9%

JSON

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a “DNS hijack attack.”

OSVersionArchitecturePackageVersionFilename
Debian12alljruby< 1.7.20.1-2jruby_1.7.20.1-2_all.deb
Debian10alljruby< 1.7.20.1-2jruby_1.7.20.1-2_all.deb
Debian999alljruby< 1.7.20.1-2jruby_1.7.20.1-2_all.deb
Debian13alljruby< 1.7.20.1-2jruby_1.7.20.1-2_all.deb
Debian12allrubygems< 3.3.15-2rubygems_3.3.15-2_all.deb
Debian11allrubygems< 3.2.5-2rubygems_3.2.5-2_all.deb
Debian999allrubygems< 3.4.20-1rubygems_3.4.20-1_all.deb
Debian13allrubygems< 3.4.20-1rubygems_3.4.20-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	jruby	< 1.7.20.1-2	jruby_1.7.20.1-2_all.deb
Debian	10	all	jruby	< 1.7.20.1-2	jruby_1.7.20.1-2_all.deb
Debian	999	all	jruby	< 1.7.20.1-2	jruby_1.7.20.1-2_all.deb
Debian	13	all	jruby	< 1.7.20.1-2	jruby_1.7.20.1-2_all.deb
Debian	12	all	rubygems	< 3.3.15-2	rubygems_3.3.15-2_all.deb
Debian	11	all	rubygems	< 3.2.5-2	rubygems_3.2.5-2_all.deb
Debian	999	all	rubygems	< 3.4.20-1	rubygems_3.4.20-1_all.deb
Debian	13	all	rubygems	< 3.4.20-1	rubygems_3.4.20-1_all.deb