CVE-2012-2126
RubyGems does not verify SSL certificate
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
Exploit likelihood
What each source reports
NVD Score used
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
CVE-2012-2126- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
CVE-2012-2126- Updated
- 2026-11-02
EUVDEUVD-2022-2619 No score
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
EUVD-2022-2619- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5mgj-mvv8-46mw No score
RubyGems does not verify SSL certificate
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
GHSA-5mgj-mvv8-46mw- Updated
- 2026-11-02
OSV No score
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
CVE-2012-2126- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2126 No score
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
DEBIAN-CVE-2012-2126- Updated
- 2026-11-02
OSVGHSA-5mgj-mvv8-46mw No score
RubyGems does not verify SSL certificate
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
GHSA-5mgj-mvv8-46mw- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-2126 No score
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
- Record
UBUNTU-CVE-2012-2126- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rubygems-updateRubyGems |
before 1.8.23 | 1.8.23 |
rubygemsDebian:12 |
before 1.8.24-1 | 1.8.24-1 |
rubygemsDebian:13 |
before 1.8.24-1 | 1.8.24-1 |
rubygemsDebian:14 |
before 1.8.24-1 | 1.8.24-1 |
rubygems-updateRubyGems |
before 1.8.23, plus listed versions 0.8.100.8.110.8.30.8.40.8.5 Show 45 moreShow less0.8.60.8.80.9.00.9.10.9.20.9.30.9.40.9.51.0.01.0.11.1.01.1.11.2.01.3.01.3.11.3.21.3.31.3.41.3.51.3.61.3.71.4.01.4.11.4.21.5.01.5.21.5.31.6.01.6.11.6.21.7.01.7.11.7.21.8.01.8.11.8.101.8.111.8.121.8.131.8.141.8.151.8.161.8.171.8.181.8.19 |
1.8.23 |
rubygemsRed Hat:openshift:1.2::el6 From an advisory covering 2 CVEs |
before 0:1.8.24-4.el6op | 0:1.8.24-4.el6op |
rubygemsRed Hat:enterprise_linux:6::client From an advisory covering 3 CVEs |
before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
rubygemsRed Hat:enterprise_linux:6::computenode From an advisory covering 3 CVEs |
before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
rubygemsRed Hat:enterprise_linux:6::server From an advisory covering 3 CVEs |
before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
rubygemsRed Hat:enterprise_linux:6::workstation From an advisory covering 3 CVEs |
before 0:1.3.7-4.el6_4 | 0:1.3.7-4.el6_4 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygemsRed Hat:enterprise_mrg:2:computenode:el6 From an advisory covering 7 CVEs |
before 0:1.8.23.2-1.el6 | 0:1.8.23.2-1.el6 |
cuminRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 7 CVEs |
before 0:0.1.5787-4.el6 | 0:0.1.5787-4.el6 |
rubygemsRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 7 CVEs |
before 0:1.8.23.2-1.el6 | 0:1.8.23.2-1.el6 |
jrubyUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.5.6-5ubuntu11.5.6-61.5.6-71.5.6-9+deb8u2build0.14.04.1~esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2126 is a medium vulnerability (CVSS 4.3) in Rubygems, published April 20, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in rubygems-update 1.8.23.
References
secunia.com/advisories/55381
ubuntu.com/usn/USN-1582-1
github.com/rubygems/rubygems/blob/1.8/History.txt
rhn.redhat.com/errata/RHSA-2013-1203.html
bugzilla.redhat.com/show_bug.cgi?id=814718
openwall.com/lists/oss-security/2012/04/20/24
Show 46 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-2126
security-tracker.debian.org/tracker/CVE-2012-2126
access.redhat.com/errata/RHSA-2013:1203
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1203.json
cve.org/CVERecord?id=CVE-2012-2125
blog.rubygems.org/2013/09/09/CVE-2013-4287.html
ubuntu.com/security/CVE-2012-2126
ruby-lang.org/en/news/2012/04/20/ruby-1-9-3-p194-is-released
Left out here: 11 versions. The JSON record has them.