GitHub Advisoryadvisory · RubyGems

GHSA-wp3j-rvfp-624h RubyGems vulnerable to DNS hijack attack

HIGH Published 2022-05-14 Modified 2023-03-10 Official page ↗
Aliases
CVE-2015-3900
Ecosystem
RubyGems
Packages
rubygems-update
Severity
High
Weaknesses
CWE-350
Reviewed
2023-03-10

Affected packages

• RubyGems rubygems-update: >= 2.0.0, < 2.0.16 → fixed in 2.0.16 • RubyGems rubygems-update: >= 2.2.0, < 2.2.4 → fixed in 2.2.4 • RubyGems rubygems-update: >= 2.4.0, < 2.4.7 → fixed in 2.4.7

Description

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Related

Alias · CVE (1)

  • CVE-2015-3900 RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API… vulnerability

Weakness · CWE (1)

  • CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action weakness

References