GitHub Advisoryadvisory · RubyGems

GHSA-qv62-xfj6-32xm RubyGems Improper Input Validation vulnerability

MEDIUM Published 2022-05-17 Modified 2023-05-04 Official page ↗
Aliases
CVE-2015-4020
Ecosystem
RubyGems
Packages
rubygems-update
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2023-05-04

Affected packages

• RubyGems rubygems-update: < 2.0.17 → fixed in 2.0.17 • RubyGems rubygems-update: >= 2.1.0.rc.1, < 2.2.5 → fixed in 2.2.5 • RubyGems rubygems-update: >= 2.3.0, < 2.4.8 → fixed in 2.4.8

Description

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.

Related

Alias · CVE (1)

  • CVE-2015-4020 RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References