VulnerabilityModified
CVE-2015-3900
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka…
MEDIUM 5.0EPSS 8.93%
Does this matter?
Lower severity and a low EPSS score (8.93%). Track it; it rarely justifies an emergency change on its own.
Description
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 8.93% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-254
- Affected
- ruby-lang/ruby · rubygems/rubygems · oracle/solaris · redhat/enterprise linux
- Source
- cve@mitre.org
References
- http://blog.rubygems.org/2015/05/14/CVE-2015-3900.htmlPatch, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html
- http://rhn.redhat.com/errata/RHSA-2015-1657.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2015/06/26/2Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.securityfocus.com/bid/75482
- https://puppet.com/security/cve/CVE-2015-3900
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356Third Party Advisory
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/Third Party Advisory
- http://blog.rubygems.org/2015/05/14/CVE-2015-3900.htmlPatch, Vendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html
- http://rhn.redhat.com/errata/RHSA-2015-1657.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2015/06/26/2Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.securityfocus.com/bid/75482
- https://puppet.com/security/cve/CVE-2015-3900
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356Third Party Advisory
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.