CVE-2015-4020

Опубликовано: 25 авг. 2015

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.

Ссылки

http://blog.rubygems.org/2015/06/08/2.2.5-released.html
Vendor Advisory
http://blog.rubygems.org/2015/06/08/2.4.8-released.html
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Third Party Advisory
http://www.securityfocus.com/bid/75431
https://github.com/rubygems/rubygems/commit/5c7bfb5
https://puppet.com/security/cve/CVE-2015-3900
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
Third Party Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/
Third Party Advisory
http://blog.rubygems.org/2015/06/08/2.2.5-released.html
Vendor Advisory
http://blog.rubygems.org/2015/06/08/2.4.8-released.html
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Third Party Advisory
http://www.securityfocus.com/bid/75431
https://github.com/rubygems/rubygems/commit/5c7bfb5
https://puppet.com/security/cve/CVE-2015-3900
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
Third Party Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*

cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03461

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2015-4020

ubuntu

почти 11 лет назад

CVE-2015-4020

redhat

около 11 лет назад

CVE-2015-4020

debian

почти 11 лет назад

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4 ...

GHSA-qv62-xfj6-32xm

github

около 4 лет назад

RubyGems Improper Input Validation vulnerability

EPSS

Процентиль: 88%

0.03461

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-20