CVE-2015-3900 RubyGems vulnerable to DNS hijack attack
MediumCVSS 5.0
EPSS 8.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | >= 2.0.0, < 2.0.16 | 2.0.16 |
| rubygems-update(RubyGems) | >= 2.2.0, < 2.2.4 | 2.2.4 |
| rubygems-update(RubyGems) | >= 2.4.0, < 2.4.7 | 2.4.7 |
| rubygems-update(RubyGems) | = 2.0.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.10 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.11 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.12 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.13 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.14 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.15 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.6 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.7 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.8 | No fix listed |
| rubygems-update(RubyGems) | = 2.0.9 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.2 | No fix listed |
| rubygems-update(RubyGems) | = 2.2.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.0 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.1 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.2 | No fix listed |
Show 49 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems-update(RubyGems) | = 2.4.3 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.4 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.5 | No fix listed |
| rubygems-update(RubyGems) | = 2.4.6 | No fix listed |
| debian/jruby(Debian:12) | < 1.7.20.1-2 | 1.7.20.1-2 |
| debian/jruby(Debian:13) | < 1.7.20.1-2 | 1.7.20.1-2 |
| debian/jruby(Debian:14) | < 1.7.20.1-2 | 1.7.20.1-2 |
| ruby-lang ruby | = 1.9 | No fix listed |
| ruby-lang ruby | = 1.9.1 | No fix listed |
| ruby-lang ruby | = 1.9.2 | No fix listed |
| ruby-lang ruby | = 1.9.3 | No fix listed |
| ruby-lang ruby | = 2.0.0 | No fix listed |
| ruby-lang ruby | = 2.1 | No fix listed |
| ruby-lang ruby | = 2.1.1 | No fix listed |
| ruby-lang ruby | = 2.1.2 | No fix listed |
| ruby-lang ruby | = 2.1.3 | No fix listed |
| ruby-lang ruby | = 2.1.4 | No fix listed |
| ruby-lang ruby | = 2.1.5 | No fix listed |
| ruby-lang ruby | = 2.2.0 | No fix listed |
| rubygems | = 2.0.0 | No fix listed |
| rubygems | = 2.0.1 | No fix listed |
| rubygems | = 2.0.2 | No fix listed |
| rubygems | = 2.0.3 | No fix listed |
| rubygems | = 2.0.4 | No fix listed |
| rubygems | = 2.0.5 | No fix listed |
| rubygems | = 2.0.6 | No fix listed |
| rubygems | = 2.0.7 | No fix listed |
| rubygems | = 2.0.8 | No fix listed |
| rubygems | = 2.0.9 | No fix listed |
| rubygems | = 2.0.10 | No fix listed |
| rubygems | = 2.0.11 | No fix listed |
| rubygems | = 2.0.12 | No fix listed |
| rubygems | = 2.0.13 | No fix listed |
| rubygems | = 2.0.14 | No fix listed |
| rubygems | = 2.0.15 | No fix listed |
| rubygems | = 2.2.0 | No fix listed |
| rubygems | = 2.2.1 | No fix listed |
| rubygems | = 2.2.2 | No fix listed |
| rubygems | = 2.2.3 | No fix listed |
| rubygems | = 2.4.0 | No fix listed |
| rubygems | = 2.4.1 | No fix listed |
| rubygems | = 2.4.2 | No fix listed |
| rubygems | = 2.4.3 | No fix listed |
| rubygems | = 2.4.4 | No fix listed |
| rubygems | = 2.4.5 | No fix listed |
| rubygems | = 2.4.6 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- www.trustwave.com third-party-advisory
- www.trustwave.com third-party-advisory
- blog.rubygems.org patch vendor-advisory
- FEDORA-2015-12501 vendor-advisory
- FEDORA-2015-12574 vendor-advisory
- FEDORA-2015-13157 vendor-advisory
- RHSA-2015:1657 third-party-advisory vendor-advisory
- [oss-security] 20150626 rubygems <2.4.8 vulnerable to DNS request hijacking (CVE-2015-3900 and CVE-2015-4020) mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- web.archive.org
- web.archive.org
- github.com exploit
- puppet.com
- github.com
- Debian Security Tracker CVE-2015-3900 vendor-advisory
- 75482 vdb-entry