Red Hat Security AdvisoryRHSA-2013:1441
rubygems security update
Released 2013-10-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop Optional (v. 6) rubygems-1.3.7-4.el6_4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) rubygems-1.3.7-4.el6_4
- Red Hat Enterprise Linux Server Optional (v. 6) rubygems-1.3.7-4.el6_4
- Red Hat Enterprise Linux Workstation Optional (v. 6) rubygems-1.3.7-4.el6_4
Fixes 3 records
Priority LOW 31
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.02467 · Published 2013-10-01 · Partial fix · 1.8.23
Priority LOW 26
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 throu…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.03331 · Published 2013-10-17 · Partial fix · 1.8.23.1, 1.8.26 +2 CWE-310
Priority LOW 23
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01362 · Published 2013-10-01 · Partial fix · 1.8.23 CWE-310
