RubySec

Providing security resources for the Ruby community

CVE-2015-4020 (rubygems-update): RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking

ADVISORIES

GEM

rubygems-update

LIBRARY

RubyGems

SEVERITY

CVSS v2.0: 5.0 (Medium)

PATCHED VERSIONS

  • ~> 2.0.17
  • ~> 2.2.5
  • >= 2.4.8

DESCRIPTION

RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb that is triggered when handling hostnames in SRV records. With a specially crafted response, a context-dependent attacker may conduct DNS hijacking attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900, which allowed redirection to an arbitrary gem server in any security domain.