RubyGems vulnerable to DNS hijack attack
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-3900US | medium5.0 | — | ||
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://blog.rubygems.org/2015/05/14/CVE-2015-3900.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.htmlWEB
- http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2015-1657.htmlWEB
- http://www.openwall.com/lists/oss-security/2015/06/26/2WEB
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlWEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3900.ymlWEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan