RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers…
Priority LOW 23CWE-310Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
Why it matters now
EPSS 0.01362 71st percentileScored 2026-11-07
Fix Partial rubygems-update (RubyGems): 1.8.23Red Hat: 3 advisoriesRed Hat: 10 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rubygems-update (RubyGems) | before 1.8.23 | 1.8.23 | Patch available | GHSA-5mgj-mvv8-46mw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rubygems-update (RubyGems) Vendor— Affected before 1.8.23 Fixed in 1.8.23 Patch available GHSA-5mgj-mvv8-46mw
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:* | up to 1.8.22 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:* | 1.8.0 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:* | 1.8.1 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:* | 1.8.2 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:* | 1.8.3 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:* | 1.8.4 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:* | 1.8.5 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:* | 1.8.6 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:* | 1.8.7 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:* | 1.8.8 | Vulnerable | rubygems |
- cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:* Versions up to 1.8.22 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.0:*:*:*:*:*:*:* Versions 1.8.0 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.2:*:*:*:*:*:*:* Versions 1.8.2 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.3:*:*:*:*:*:*:* Versions 1.8.3 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.4:*:*:*:*:*:*:* Versions 1.8.4 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.5:*:*:*:*:*:*:* Versions 1.8.5 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.6:*:*:*:*:*:*:* Versions 1.8.6 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.7:*:*:*:*:*:*:* Versions 1.8.7 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.8:*:*:*:*:*:*:* Versions 1.8.8 Vulnerable ·rubygems
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:* | 1.8.9 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:* | 1.8.10 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:* | 1.8.11 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:* | 1.8.12 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:* | 1.8.13 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:* | 1.8.14 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:* | 1.8.15 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:* | 1.8.16 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:* | 1.8.17 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:* | 1.8.18 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:* | 1.8.19 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:* | 1.8.20 | Vulnerable | rubygems |
| cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:* | 1.8.21 | Vulnerable | rubygems |
| cpe:2.3:a:redhat:openshift:1.2.2:*:*:*:enterprise:*:*:* | 1.2.2 | Running on | Red Hat |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* | 12.04 | Running on | Canonical |
- cpe:2.3:a:rubygems:rubygems:1.8.9:*:*:*:*:*:*:* Versions 1.8.9 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.10:*:*:*:*:*:*:* Versions 1.8.10 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.11:*:*:*:*:*:*:* Versions 1.8.11 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.12:*:*:*:*:*:*:* Versions 1.8.12 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.13:*:*:*:*:*:*:* Versions 1.8.13 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.14:*:*:*:*:*:*:* Versions 1.8.14 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.15:*:*:*:*:*:*:* Versions 1.8.15 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.16:*:*:*:*:*:*:* Versions 1.8.16 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.17:*:*:*:*:*:*:* Versions 1.8.17 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.18:*:*:*:*:*:*:* Versions 1.8.18 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.19:*:*:*:*:*:*:* Versions 1.8.19 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.20:*:*:*:*:*:*:* Versions 1.8.20 Vulnerable ·rubygems
- cpe:2.3:a:rubygems:rubygems:1.8.21:*:*:*:*:*:*:* Versions 1.8.21 Vulnerable ·rubygems
- cpe:2.3:a:redhat:openshift:1.2.2:*:*:*:enterprise:*:*:* Versions 1.2.2 Running on ·Red Hat
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* Versions 12.04 Running on ·Canonical
Remediation
- Fix · GHSA-5mgj-mvv8-46mw rubygems-update (RubyGems) Fixed in 1.8.23 Advisory →
Red Hat 3 advisories
- RHSA-2013:1852 Released 2013-12-17 · Red Hat rating ModerateRed Hat Enterprise MRG Grid 2.4 security update
- Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 rubygems-1.8.23.2-1.el6
- Red Hat MRG Grid for RHEL 6 Server v.2 cumin-0.1.5787-4.el6, rubygems-1.8.23.2-1.el6
- Red Hat MRG Management for RHEL 6 Server v.2 cumin-0.1.5787-4.el6
- RHSA-2013:1441 Released 2013-10-17 · Red Hat rating Moderaterubygems security update
- Red Hat Enterprise Linux Desktop Optional (v. 6) rubygems-1.3.7-4.el6_4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) rubygems-1.3.7-4.el6_4
- Red Hat Enterprise Linux Server Optional (v. 6) rubygems-1.3.7-4.el6_4
- Red Hat Enterprise Linux Workstation Optional (v. 6) rubygems-1.3.7-4.el6_4
- RHSA-2013:1203 Released 2013-09-04 · Red Hat rating Moderaterubygems security update
- RHOSE Client 1.2 rubygems-1.8.24-4.el6op
- RHOSE Infrastructure 1.2 rubygems-1.8.24-4.el6op
- Red Hat OpenShift Enterprise Node rubygems-1.8.24-4.el6op
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Subscription Asset Manager | Affected | No fix planned: Will not fix |
| RHOSE Client 1.2 | Fixed | RHSA-2013:1203 |
| RHOSE Infrastructure 1.2 | Fixed | RHSA-2013:1203 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2013:1441 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2013:1441 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2013:1441 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2013:1441 |
| Red Hat MRG Grid Execute Node for RHEL 6 ComputeNode v.2 | Fixed | RHSA-2013:1852 |
| Red Hat MRG Grid for RHEL 6 Server v.2 | Fixed | RHSA-2013:1852 |
| Red Hat MRG Management for RHEL 6 Server v.2 | Fixed | RHSA-2013:1852 |
| Red Hat OpenShift Enterprise Node | Fixed | RHSA-2013:1203 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-2126
- 2026-10-03 Alias added: GHSA-5mgj-mvv8-46mw
References
Advisory 5
Other 6
- https://bugzilla.redhat.com/show_bug.cgi?id=814718
- [oss-security] 20120420 Re: CVE Request -- rubygems: Two security fixes in upstream v1.8.23 version
- https://github.com/rubygems/rubygems/commit/d4c7eafb8efe1e13a7abf5be5a5b4548870b15b7
- https://github.com/rubygems/rubygems
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2012-2126.yml
- http://www.ubuntu.com/usn/USN-1582-1
More Rubygems vulnerabilities
- TI-2017-00851 Deserialization of untrusted data in HackerOne RubyGems CVSS 3.0CRITICAL 9.8
- TI-2017-00849 Path traversal in HackerOne RubyGems CVSS 3.0HIGH 7.5
- TI-2017-00847 Code injection in HackerOne RubyGems CVSS 3.0CRITICAL 9.8
- TI-2018-15731 RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier… CVSS 3.0CRITICAL 9.8
- TI-2019-05977 An issue was discovered in RubyGems 2.6 and later through 3.0.2. CVSS 3.1HIGH 8.8
- TI-2017-00848 RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem… CVSS 3.0HIGH 7.5
Sources
- CVE-2012-2126 · CVE Program
- CVE-2012-2126 · NVD
- FIRST EPSS
- GHSA-5mgj-mvv8-46mw · GitHub Advisory Database · CC BY 4.0
- CVE-2012-2126 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences