CVE-2012-2125 RubyGems HTTPS to HTTP redirect
MediumCVSS 5.8
EPSS 2.5%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | < 1.8.23 | 1.8.23 |
| rubygems-update(RubyGems) | = 0.8.10 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.11 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.3 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.4 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.5 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.6 | No fix listed |
| rubygems-update(RubyGems) | = 0.8.8 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.0 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.1 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.2 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.3 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.4 | No fix listed |
| rubygems-update(RubyGems) | = 0.9.5 | No fix listed |
| rubygems-update(RubyGems) | = 1.0.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.0.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.1.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.1.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.2.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.3 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.4 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.5 | No fix listed |
Show 63 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | = 1.3.6 | No fix listed |
| rubygems-update(RubyGems) | = 1.3.7 | No fix listed |
| rubygems-update(RubyGems) | = 1.4.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.4.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.4.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.5.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.5.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.5.3 | No fix listed |
| rubygems-update(RubyGems) | = 1.6.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.6.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.6.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.7.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.7.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.7.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.0 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.1 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.10 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.11 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.12 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.13 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.14 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.15 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.16 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.17 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.18 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.19 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.2 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.20 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.21 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.22 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.3 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.4 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.5 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.6 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.7 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.8 | No fix listed |
| rubygems-update(RubyGems) | = 1.8.9 | No fix listed |
| debian/rubygems(Debian:12) | < 1.8.24-1 | 1.8.24-1 |
| debian/rubygems(Debian:13) | < 1.8.24-1 | 1.8.24-1 |
| debian/rubygems(Debian:14) | < 1.8.24-1 | 1.8.24-1 |
| rubygems | <= 1.8.22 | No fix listed |
| rubygems | = 1.8.0 | No fix listed |
| rubygems | = 1.8.1 | No fix listed |
| rubygems | = 1.8.2 | No fix listed |
| rubygems | = 1.8.3 | No fix listed |
| rubygems | = 1.8.4 | No fix listed |
| rubygems | = 1.8.5 | No fix listed |
| rubygems | = 1.8.6 | No fix listed |
| rubygems | = 1.8.7 | No fix listed |
| rubygems | = 1.8.8 | No fix listed |
| rubygems | = 1.8.9 | No fix listed |
| rubygems | = 1.8.10 | No fix listed |
| rubygems | = 1.8.11 | No fix listed |
| rubygems | = 1.8.12 | No fix listed |
| rubygems | = 1.8.13 | No fix listed |
| rubygems | = 1.8.14 | No fix listed |
| rubygems | = 1.8.15 | No fix listed |
| rubygems | = 1.8.16 | No fix listed |
| rubygems | = 1.8.17 | No fix listed |
| rubygems | = 1.8.18 | No fix listed |
| rubygems | = 1.8.19 | No fix listed |
| rubygems | = 1.8.20 | No fix listed |
| rubygems | = 1.8.21 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com patch
- github.com
- RHSA-2013:1203 vendor-advisory
- RHSA-2013:1441 vendor-advisory
- RHSA-2013:1852 vendor-advisory
- [oss-security] 20120420 Re: CVE Request -- rubygems: Two security fixes in upstream v1.8.23 version mailing-list patch
- USN-1582-1 vendor-advisory
- github.com exploit
- github.com
- github.com product
- Debian Security Tracker CVE-2012-2125 vendor-advisory
- 55381 third-party-advisory
- bugs.debian.org issue-tracking