CVE-2015-3900
CVE-2015-3900
This page contains facts from public vulnerability sources. Check the original advisory before updating.
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
EPSS 8.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- http://rhn.redhat.com/errata/RHSA-2015-1657.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
- http://www.openwall.com/lists/oss-security/2015/06/26/2
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/
- http://www.securityfocus.com/bid/75482
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
- http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html
- https://puppet.com/security/cve/CVE-2015-3900
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-3900