CVE-2015-4020
published 2015-08-25CVE-2015-4020: RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows…
PriorityP427medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
3.46%
87.8th percentile
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jruby | — | — |
| debian | rubygems | — | — |
| oracle | solaris | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
| rubygems | rubygems | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa5.0MEDIUM
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
RubyGems Improper Input Validation vulnerability
osv·2022-05-17·CVSS 5.0
CVE-2015-4020 [MEDIUM] RubyGems Improper Input Validation vulnerability
RubyGems Improper Input Validation vulnerability
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."
NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.
GHSA
RubyGems Improper Input Validation vulnerability
ghsa·2022-05-17·CVSS 5.0
CVE-2015-4020 [MEDIUM] CWE-20 RubyGems Improper Input Validation vulnerability
RubyGems Improper Input Validation vulnerability
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."
NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.
Red Hat
rubygems: incomplete fix for CVE-2015-3900
vendor_redhat·2015-05-18·CVSS 5.0
CVE-2015-4020 [MEDIUM] CWE-20 rubygems: incomplete fix for CVE-2015-3900
rubygems: incomplete fix for CVE-2015-3900
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain.
Statement: This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6, Red Hat Ente
Debian
CVE-2015-4020: jruby - RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does no...
vendor_debian·2015·CVSS 5.0
CVE-2015-4020 [MEDIUM] CVE-2015-4020: jruby - RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does no...
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Scope: local
bookworm: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
No public exploits indexed.
HackerOne
Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
hackerone·2017-08-30·CVSS 5.0
[MEDIUM] Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
**Description:**
The RubyGems client supports a gem server API discovery functionality,
which is used when pushing or pulling gems to a gem distribution/hosting
server, like RubyGems.org. This functionality is provided via a SRV DNS
request to the users gem source hostname prepended with "_rubygems._tcp.".
The response to this request tells the RubyGems client (aka: the gem
command) where the users gem server API is. In the default RubyGems
scenario, with a gem source of https://rubygems.org, the users SRV DNS
request and reply will look like this:
~ $ dig srv _rubygems._tcp.rubygems.org +short
0 1 80 api.rubygems.org.
Due to a deficiency in DNS response verification, a MiTM positioned
attacker can poison the DNS response t
Bugzilla
CVE-2015-4020 rubygems: incomplete fix for CVE-2015-3900
bugzilla·2015-08-04·CVSS 5.0
CVE-2015-4020 [MEDIUM] CVE-2015-4020 rubygems: incomplete fix for CVE-2015-3900
CVE-2015-4020 rubygems: incomplete fix for CVE-2015-3900
RubyGems before versions 2.0.16, 2.2.4 and 2.4.7 did not verify the API endpoint hostname retrieved through an SRV record (CVE-2015-3900). Fix for this flaw was found incomplete, as it was still possible for an attacker to bypass the hostname restriction.
Incomplete fix for CVE-2015-3900:
https://github.com/rubygems/rubygems/commit/6bbee35
Upstream fix for CVE-2015-4020:
https://github.com/rubygems/rubygems/commit/5c7bfb5
Statement:
This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6, Red Hat Enterprise MRG 2.5, Red Hat Satellite 6, Red Hat Openstack 5, Red Hat Openshift Enterprise 2, as the packages did not include the incomplete fix.
This issue did not affect the versions of ruby as s
Bugzilla
CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()
bugzilla·2015-06-26·CVSS 5.0
CVE-2015-3900 [MEDIUM] CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()
CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint()
RubyGems before versions 2.0.16, 2.2.4 and 2.4.7 did not verify the API endpoint hostname retrieved through an SRV record.
This left clients open to a DNS hijack attack, whereby an attacker could return a SRV of their choosing and get the client to use it.
Upstream patch: https://github.com/rubygems/rubygems/commit/6bbee35
External References:
http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html
Statement:
This issue did not affect the versions of rubygems as shipped with Red Hat Enterprise Linux 6, Red Hat Enterprise MRG 2.5, Red Hat Satellite 6, Red Hat Openstack 5, Red Hat Openshift Enterprise 2 as they did not include support for getting API endpoint using SRV DNS records.
This issue did not affect the versi
http://blog.rubygems.org/2015/06/08/2.2.5-released.htmlhttp://blog.rubygems.org/2015/06/08/2.4.8-released.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/75431https://github.com/rubygems/rubygems/commit/5c7bfb5https://puppet.com/security/cve/CVE-2015-3900https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/http://blog.rubygems.org/2015/06/08/2.2.5-released.htmlhttp://blog.rubygems.org/2015/06/08/2.4.8-released.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlhttp://www.securityfocus.com/bid/75431https://github.com/rubygems/rubygems/commit/5c7bfb5https://puppet.com/security/cve/CVE-2015-3900https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/
2015-08-25
Published