Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2015-4020
4.3
MEDIUMCVSS v2
Published
August 25, 2015
Affected
1 project
Assigned by
MITRE
Severity scale
010
Description
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
ruby/rubygems
GitHubLibrary packaging and distribution for Ruby.
GitHubLibrary packaging and distribution for Ruby.= 2.4.3, = 2.2.1, = 2.2.2, = 2.0.0, = 2.0.13, = 2.0.6, = 2.0.15, = 2.0.5, = 2.0.16, = 2.0.9, = 2.2.0, = 2.4.2, = 2.0.10, = 2.0.3, = 2.4.4, = 2.4.5, = 2.0.11, = 2.0.4, = 2.2.3, = 2.4.6, = 2.0.14, = 2.4.0, = 2.0.1, = 2.0.2, = 2.0.12, = 2.2.4, = 2.4.7, = 2.0.7, = 2.0.8, = 2.4.1NVD