CVE-2015-3900
Summary
| CVE | CVE-2015-3900 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-06-24 14:59:00 UTC |
| Updated | 2019-04-22 17:48:00 UTC |
| Description | RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." |
Risk And Classification
Problem Types: CWE-254
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Oracle | Solaris | 11.3 | All | All | All |
| Operating System | Oracle | Solaris | 11.3 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9.1 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9.2 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9.3 | All | All | All |
| Application | Ruby-lang | Ruby | 2.0.0 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1 | - | All | All |
| Application | Ruby-lang | Ruby | 2.1.1 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.2 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.3 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.4 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.5 | All | All | All |
| Application | Ruby-lang | Ruby | 2.2.0 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9.1 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9.2 | All | All | All |
| Application | Ruby-lang | Ruby | 1.9.3 | All | All | All |
| Application | Ruby-lang | Ruby | 2.0.0 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1 | - | All | All |
| Application | Ruby-lang | Ruby | 2.1.1 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.2 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.3 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.4 | All | All | All |
| Application | Ruby-lang | Ruby | 2.1.5 | All | All | All |
| Application | Ruby-lang | Ruby | 2.2.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.1 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.10 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.11 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.12 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.13 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.14 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.15 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.2 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.3 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.4 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.5 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.6 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.7 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.8 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.9 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.1 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.2 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.3 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.1 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.2 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.3 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.4 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.5 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.6 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.1 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.10 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.11 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.12 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.13 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.14 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.15 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.2 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.3 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.4 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.5 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.6 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.7 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.8 | All | All | All |
| Application | Rubygems | Rubygems | 2.0.9 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.1 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.2 | All | All | All |
| Application | Rubygems | Rubygems | 2.2.3 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.0 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.1 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.2 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.3 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.4 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.5 | All | All | All |
| Application | Rubygems | Rubygems | 2.4.6 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| [SECURITY] Fedora 21 Update: rubygems-2.2.5-100.fc21 | FEDORA | lists.fedoraproject.org | |
| oss-security - rubygems <2.4.8 vulnerable to DNS request hijacking (CVE-2015-3900 and CVE-2015-4020) | MLIST | www.openwall.com | Third Party Advisory |
| CVE-2015-3900 Request hijacking vulnerability in RubyGems 2.4.6 and earlier | RubyGems.org | CONFIRM | blog.rubygems.org | Patch, Vendor Advisory |
| [SECURITY] Fedora 23 Update: rubygems-2.4.8-100.fc23 | FEDORA | lists.fedoraproject.org | |
| Attacking Ruby Gem Security with CVE-2015-3900 | MISC | www.trustwave.com | Third Party Advisory |
| RubyGems CVE-2015-3900 Security Bypass Vulnerability | BID | www.securityfocus.com | |
| Oracle Solaris Third Party Bulletin - October 2015 | CONFIRM | www.oracle.com | Third Party Advisory |
| www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007 | MISC | www.trustwave.com | Third Party Advisory |
| [SECURITY] Fedora 22 Update: rubygems-2.4.8-100.fc22 | FEDORA | lists.fedoraproject.org | |
| CVE-2015-3900, CVE-2015-4020 - Request Hijacking Vulnerability in RubyGems | Puppet | CONFIRM | puppet.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.