RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking
Published: June 08, 2015
SECURITY IDENTIFIERS
- CVE: CVE-2015-4020 (NVD)
- GHSA: GHSA-qv62-xfj6-32xm
- Vendor Advisory: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
GEM
LIBRARY
SEVERITY
CVSS v2.0: 5.0 (Medium)
PATCHED VERSIONS
~> 2.0.17
~> 2.2.5
>= 2.4.8
DESCRIPTION
RubyGems contains a flaw in the api_endpoint() function in remote_fetcher.rb that is triggered when handling hostnames in SRV records. With a specially crafted response, a context-dependent attacker may conduct DNS hijacking attacks. This vulnerability is due to an incomplete fix for CVE-2015-3900, which allowed redirection to an arbitrary gem server in any security domain.