GHSA-wp3j-rvfp-624h CVE-2015-3900
RubyGems vulnerable to DNS hijack attack
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 8.87%
- Chance of exploitation in the next 30 days. Higher than 95.22% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
- Fix
2.0.16- Upgrade rubygems-update to this version or later
Description
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rubygems-update | >= 2.0.0, < 2.0.16 |
2.0.16 |
| rubygems-update | >= 2.2.0, < 2.2.4 |
2.2.4 |
| rubygems-update | >= 2.4.0, < 2.4.7 |
2.4.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rubygems-update RubyGems → 2.0.16
- bundler
bundle update rubygems-update # Gemfile: gem "rubygems-update", ">= 2.0.16"
Weakness
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
How to prevent it
- Architecture and Design: Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.
- Implementation: Perform proper forward and reverse DNS lookups to detect DNS spoofing.
References
Advisories
Other links
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3…
- puppet.com/security/cve/CVE-2015-3900
- web.archive.org/web/20170331091241/https://puppet.com/security/cve/CVE-2015-3900
- web.archive.org/web/20200228055155/http://www.securityfocus.com/bid/75482
- trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007
- trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-…
- blog.rubygems.org/2015/05/14/CVE-2015-3900.html
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html
- lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
- lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html
- rhn.redhat.com/errata/RHSA-2015-1657.html
- openwall.com/lists/oss-security/2015/06/26/2
- oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-228f-g3h7-3fj3 RubyGems HTTPS to HTTP redirect | Medium | Also affects rubygems-update |
| GHSA-5mgj-mvv8-46mw RubyGems does not verify SSL certificate | Medium | Also affects rubygems-update |
| GHSA-qv62-xfj6-32xm RubyGems Improper Input Validation vulnerability | Medium | Also affects rubygems-update |
| GHSA-9qvm-2vhf-q649 RubyGems Regular Expression Denial of Service | Medium | Also affects rubygems-update |
| GHSA-8qxg-mff5-j3wc RubyGems Path Traversal vulnerability | Medium | Also affects rubygems-update |
| GHSA-9j7m-rjqx-48vh RubyGems Regular Expression Denial of Service vulnerability | Medium | Also affects rubygems-update |
| GHSA-p7f2-rr42-m9xm RubyGems Improper Input Validation vulnerability | High | Also affects rubygems-update |
| GHSA-qj2w-mw2r-pv39 RubyGems Deserialization of Untrusted Data vulnerability | High | Also affects rubygems-update |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor