CVE-2015-3900

Опубликовано: 24 июн. 2015

Источник: nvd

CVSS2: 5

EPSS Низкий

Описание

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.1:-:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.1.3:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.1.4:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.1.5:*:*:*:*:*:*:*

cpe:2.3:a:ruby-lang:ruby:2.2.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 85%

0.02401

Низкий

5 Medium

CVSS2

Дефекты

CWE-254

Связанные уязвимости

CVE-2015-3900

ubuntu

больше 10 лет назад

CVE-2015-3900

redhat

больше 10 лет назад

CVE-2015-3900

debian

больше 10 лет назад

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4 ...

GHSA-wp3j-rvfp-624h

github

больше 3 лет назад

RubyGems vulnerable to DNS hijack attack

openSUSE-SU-2017:1128-1

suse-cvrf

почти 9 лет назад

Security update for ruby2.1

EPSS

Процентиль: 85%

0.02401

Низкий

5 Medium

CVSS2

Дефекты

CWE-254