Published: 01/10/2013 Updated: 14/01/2014

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

RubyGems prior to 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote malicious users to observe or modify a gem during installation via a man-in-the-middle attack.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rubygems rubygems 1.8.19
rubygems rubygems 1.8.18
rubygems rubygems 1.8.10
rubygems rubygems 1.8.9
rubygems rubygems 1.8.2
rubygems rubygems 1.8.1
rubygems rubygems 1.8.17
rubygems rubygems 1.8.16
rubygems rubygems 1.8.15
rubygems rubygems 1.8.8
rubygems rubygems 1.8.7
rubygems rubygems 1.8.0
rubygems rubygems 1.8.21
rubygems rubygems 1.8.20
rubygems rubygems 1.8.12
rubygems rubygems 1.8.11
rubygems rubygems 1.8.4
rubygems rubygems 1.8.3
rubygems rubygems
rubygems rubygems 1.8.14
rubygems rubygems 1.8.13
rubygems rubygems 1.8.6
rubygems rubygems 1.8.5

Debian Bug report logs - #670228 CVE-2012-2125 CVE-2012-2126 Package: rubygems; Maintainer for rubygems is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <muehlenhoff@univentionde> Date: Tue, 24 Apr 2012 09:27:02 UTC Severity: grave Tags: securit ...

Several security issues were fixed in ruby191 ...

RubyGems could be made to download and install malicious gem files ...

Synopsis Moderate: Red Hat Enterprise MRG Grid 24 security update Type/Severity Security Advisory: Moderate Topic Updated Grid component packages that fix multiple security issues are nowavailable for Red Hat Enterprise MRG 24 for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated thi ...

Synopsis Moderate: rubygems security update Type/Severity Security Advisory: Moderate Topic An updated rubygems package that fixes three security issues is nowavailable for Red Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerabi ...

Synopsis Moderate: rubygems security update Type/Severity Security Advisory: Moderate Topic An updated rubygems package that fixes two security issues is now availablefor Red Hat OpenShift Enterprise 122The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common V ...

RubyGems before 1823 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack ...

NVD-CWE-Other http://rhn.redhat.com/errata/RHSA-2013-1203.html http://www.ubuntu.com/usn/USN-1582-1/http://www.openwall.com/lists/oss-security/2012/04/20/24 https://bugzilla.redhat.com/show_bug.cgi?id=814718 https://github.com/rubygems/rubygems/blob/1.8/History.txt http://secunia.com/advisories/55381 http://rhn.redhat.com/errata/RHSA-2013-1441.html http://rhn.redhat.com/errata/RHSA-2013-1852.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670228 https://nvd.nist.gov https://usn.ubuntu.com/1583-1/

CVE-2012-2125

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect