RubyGems CVE-2017-0902 Security Bypass Vulnerability

Bugtraq ID:	100586
Class:	Design Error
CVE:	CVE-2017-0902
Remote:	Yes
Local:	No
Published:	Aug 31 2017 12:00AM
Updated:	Aug 31 2017 12:00AM
Credit:	Jonathan Claudius
Vulnerable:	RubyGems RubyGems 2.4.8 RubyGems RubyGems 2.4.7 RubyGems RubyGems 2.4.6 RubyGems RubyGems 2.4.5 RubyGems RubyGems 2.4.4 RubyGems RubyGems 2.4.3 RubyGems RubyGems 2.4.2 RubyGems RubyGems 2.4.1 RubyGems RubyGems 2.4 RubyGems RubyGems 2.2.4 RubyGems RubyGems 2.2.3 RubyGems RubyGems 2.2.2 RubyGems RubyGems 2.2.1 RubyGems RubyGems 2.2 RubyGems RubyGems 2.0.15 RubyGems RubyGems 2.0.14 RubyGems RubyGems 2.0.13 RubyGems RubyGems 2.0.12 RubyGems RubyGems 2.0.11 RubyGems RubyGems 2.0.10 RubyGems RubyGems 2.0.7 RubyGems RubyGems 2.0.6 RubyGems RubyGems 2.0.5 RubyGems RubyGems 2.0.4 RubyGems RubyGems 2.0.3 RubyGems RubyGems 2.0.2 RubyGems RubyGems 2.0.1 RubyGems RubyGems 2.0 RubyGems RubyGems 2.6.12 RubyGems RubyGems 2.0.9 RubyGems RubyGems 2.0.8
Not Vulnerable:	RubyGems RubyGems 2.6.13

RubyGems CVE-2017-0902 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

RubyGems CVE-2017-0902 Security Bypass Vulnerability

References:

• [RemoteFetcher] Avoid DNS Hijacking Vulnerability (RubyGems)
  
• 2.6.13 Released (RubyGems)
  
• Bug 1487589 - (CVE-2017-0902) CVE-2017-0902 rubygems: DNS hijacking vulnerabilit (Red Hat)
  
• CVE-2017-0902 (Red Hat)
  
• Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier (Jonathan Claudius (claudijd))
  
• Rubygems Homepage (Rubygems)