Lucene search
RubySecRUBY:RUBYGEMS-UPDATE-2015-4020HistoryJun 07, 2015 - 9:00 p.m.
RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking
2015-06-0721:00:00
RubySec
rubysec.com
12
RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb
that is triggered when handling hostnames in SRV records. With a specially
crafted response, a context-dependent attacker may conduct DNS hijacking
attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900,
which allowed redirection to an arbitrary gem server in any security domain.
| CPE | Name | Operator | Version |
|---|---|---|---|
| rubygems-update | le | 2.0.16 | |
| rubygems-update | ge | 2.1.0 | |
| rubygems-update | le | 2.2.4 | |
| rubygems-update | ge | 2.3.0 | |
| rubygems-update | lt | 2.4.8 |
Related
nessus
nessus
Fedora 21 : rubygems-2.2.5-100.fc21 (2015-13157)
2015-08-20 00:00:00
Fedora 22 : rubygems-2.4.8-100.fc22 (2015-12574)
2015-08-11 00:00:00
fedora
fedora
[SECURITY] Fedora 22 Update: rubygems-2.4.8-100.fc22
2015-08-11 02:06:59
[SECURITY] Fedora 23 Update: rubygems-2.4.8-100.fc23
2015-08-10 10:06:28
[SECURITY] Fedora 21 Update: rubygems-2.2.5-100.fc21
2015-08-19 08:17:15
openvas
openvas
Fedora Update for rubygems FEDORA-2015-13157
2015-08-20 00:00:00
Mageia: Security Advisory (MGASA-2015-0345)
2015-10-15 00:00:00
Fedora Update for rubygems FEDORA-2015-12574
2015-08-11 00:00:00
ubuntucve
ubuntucve
CVE-2015-3900
2015-06-24 00:00:00
CVE-2015-4020
2015-08-25 00:00:00
veracode
veracode
Man-in-the-Middle (MitM)
2019-01-15 09:07:12
github
github
RubyGems vulnerable to DNS hijack attack
2022-05-14 01:08:49
RubyGems Improper Input Validation vulnerability
2022-05-17 00:16:50
threatpost
threatpost
RubyGems Patches Serious Redirection Vulnerability
2015-06-23 09:55:51
hackerone
hackerone
RubyGems: Request Hijacking Vulnerability In RubyGems 2.4.6 And Earlier
2015-05-06 00:00:00
RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
2017-04-02 17:31:05
cve
cve
CVE-2015-3900
2015-06-24 14:59:00
CVE-2015-4020
2015-08-25 17:59:00
osv
osv
RubyGems vulnerable to DNS hijack attack
2022-05-14 01:08:49
RubyGems Improper Input Validation vulnerability
2022-05-17 00:16:50
redhat
redhat
(RHSA-2015:1657) Important: rh-ruby22-ruby security update
2015-08-24 00:00:00
mageia
mageia
Updated ruby-RubyGems packages fix security vulnerabilities
2015-09-08 20:55:59
prion
prion
Design/Logic Flaw
2015-06-24 14:59:00
Design/Logic Flaw
2015-08-25 17:59:00
debiancve
debiancve
CVE-2015-3900
2015-06-24 14:59:00
CVE-2015-4020
2015-08-25 17:59:00
freebsd
freebsd
rubygems -- request hijacking vulnerability
2015-05-14 00:00:00
rubygems
rubygems
CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()
2015-05-13 21:00:00
amazon
amazon
suse
suse
Security update for ruby2.1 (important)
2017-04-28 18:11:28
Security update for ruby2.1 (important)
2017-04-20 12:08:57
Related for RUBY:RUBYGEMS-UPDATE-2015-4020