CVE-2014-0036 rbovirt uses the rest-client gem with SSL verification disabled
MediumCVSS 6.8
EPSS 2.0%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rbovirt(RubyGems) | < 0.0.24 | 0.0.24 |
| rubygems rbovirt(RubyGems) | = 0.0.1 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.10 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.11 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.12 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.13 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.14 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.15 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.16 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.17 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.18 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.19 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.2 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.20 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.21 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.22 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.23 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.3 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.4 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.5 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.6 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.7 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.8 | No fix listed |
| rubygems rbovirt(RubyGems) | = 0.0.9 | No fix listed |
| amos benari rbovirt | <= 0.0.23 | No fix listed |
Show 22 more
| Product | Affected versions | Fixed in |
|---|---|---|
| amos benari rbovirt | = 0.0.1 | No fix listed |
| amos benari rbovirt | = 0.0.2 | No fix listed |
| amos benari rbovirt | = 0.0.3 | No fix listed |
| amos benari rbovirt | = 0.0.4 | No fix listed |
| amos benari rbovirt | = 0.0.5 | No fix listed |
| amos benari rbovirt | = 0.0.6 | No fix listed |
| amos benari rbovirt | = 0.0.7 | No fix listed |
| amos benari rbovirt | = 0.0.8 | No fix listed |
| amos benari rbovirt | = 0.0.9 | No fix listed |
| amos benari rbovirt | = 0.0.10 | No fix listed |
| amos benari rbovirt | = 0.0.11 | No fix listed |
| amos benari rbovirt | = 0.0.12 | No fix listed |
| amos benari rbovirt | = 0.0.13 | No fix listed |
| amos benari rbovirt | = 0.0.14 | No fix listed |
| amos benari rbovirt | = 0.0.15 | No fix listed |
| amos benari rbovirt | = 0.0.16 | No fix listed |
| amos benari rbovirt | = 0.0.17 | No fix listed |
| amos benari rbovirt | = 0.0.18 | No fix listed |
| amos benari rbovirt | = 0.0.19 | No fix listed |
| amos benari rbovirt | = 0.0.20 | No fix listed |
| amos benari rbovirt | = 0.0.21 | No fix listed |
| amos benari rbovirt | = 0.0.22 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- FEDORA-2014-3573 vendor-advisory
- FEDORA-2014-3526 vendor-advisory
- [oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client mailing-list
- github.com exploit
- github.com
- github.com product