Red Hat Security AdvisoryRHSA-2013:1203
rubygems security update
Released 2013-09-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHOSE Client 1.2 rubygems-1.8.24-4.el6op
- RHOSE Infrastructure 1.2 rubygems-1.8.24-4.el6op
- Red Hat OpenShift Enterprise Node rubygems-1.8.24-4.el6op
Fixes 2 records
Priority LOW 31
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.02467 · Published 2013-10-01 · Partial fix · 1.8.23
Priority LOW 23
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01362 · Published 2013-10-01 · Partial fix · 1.8.23 CWE-310
