Every CVE Search/ Get API key

CVE-2015-3900

RubyGems vulnerable to DNS hijack attack

5.0 MediumFix available

CVE-2015-3900 is a medium vulnerability (CVSS 5.0) in Ruby-lang Ruby, published June 24, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.87%, the 95th percentile. Fixed in rubygems-update 2.0.16.

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Exploit likelihood

8.87%Up 6.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
CVE-2015-3900
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-254
Updated
2026-11-02
CVE List No score

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
CVE-2015-3900
Updated
2026-11-02
EUVDEUVD-2022-5611 No score

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
EUVD-2022-5611
Updated
2026-11-03
GitHub AdvisoriesGHSA-wp3j-rvfp-624h No score

RubyGems vulnerable to DNS hijack attack

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
GHSA-wp3j-rvfp-624h
Weakness
CWE-350
Updated
2026-11-02
OSV No score

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
CVE-2015-3900
Updated
2026-11-02
OSVDEBIAN-CVE-2015-3900 No score

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
DEBIAN-CVE-2015-3900
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-wp3j-rvfp-624h No score

RubyGems vulnerable to DNS hijack attack

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Record
GHSA-wp3j-rvfp-624h
Weakness
CWE-350
Updated
2026-11-02
OSVMGASA-2015-0345 No score

Updated ruby-RubyGems packages fix security vulnerabilities

Updated ruby-RubyGems package fixes security vulnerability:

RubyGems does not validate the hostname when fetching gems or making API request, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack" (CVE-2015-3900).

Record
MGASA-2015-0345
Updated
2026-11-02
OSVopenSUSE-SU-2024:10090-1 No score

libruby2_3-2_3-2.3.1-1.6 on GA media

These are all security issues fixed in the libruby2_3-2_3-2.3.1-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10090-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10481-1 No score

libruby2_2-2_2-2.2.5-1.5 on GA media

These are all security issues fixed in the libruby2_2-2_2-2.2.5-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10481-1
Updated
2026-11-02
OSVSUSE-SU-2017:1067-1 No score

Security update for ruby2.1

This ruby2.1 update to version 2.1.9 fixes the following issues:

Security issues fixed:

  • CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new'initialize' (bsc#1018808)
  • CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495)
  • CVE-2015-3900: hostname validation does not work when fetching gems or making API requests (bsc#936032)
  • CVE-2015-1855: Ruby'a OpenSSL extension suffers a vulnerability through overly permissive matching of hostnames (bsc#926974)
  • CVE-2014-4975: off-by-one stack-based buffer overflow in the encodes() function (bsc#887877)

Bugfixes:

  • SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly (bsc#1014863)
  • Segmentation fault after pack & ioctl & unpack (bsc#909695)
  • Ruby:HTTP Header injection in 'net/http' (bsc#986630)

ChangeLog:

Record
SUSE-SU-2017:1067-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rubygems-update
RubyGems
 2.0.0 up to 2.0.16
2.0.16
rubygems-update
RubyGems
 2.2.0 up to 2.2.4
2.2.4
rubygems-update
RubyGems
 2.4.0 up to 2.4.7
2.4.7
jruby
Debian:12
 before 1.7.20.1-2
1.7.20.1-2
jruby
Debian:13
 before 1.7.20.1-2
1.7.20.1-2
jruby
Debian:14
 before 1.7.20.1-2
1.7.20.1-2
rubygems-update
RubyGems
 2.0.0 up to 2.0.16, plus listed versions
2.0.102.0.112.0.122.0.132.0.14
Show 9 moreShow less
2.0.152.0.22.0.32.0.42.0.52.0.62.0.72.0.82.0.9
2.0.16
rubygems-update
RubyGems
 2.2.0 up to 2.2.4, plus listed versions
2.2.12.2.22.2.3
2.2.4
rubygems-update
RubyGems
 2.4.0 up to 2.4.7, plus listed versions
2.4.12.4.22.4.32.4.42.4.52.4.6
2.4.7
ruby-RubyGems
Mageia:4
 before 2.1.11-3.1.mga4
2.1.11-3.1.mga4
Show 48 moreShow less
Affected packages
PackageAffectedFixed
ruby-RubyGems
Mageia:5
 before 2.1.11-5.1.mga5
2.1.11-5.1.mga5
rh-ruby22-ruby
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-ruby-debuginfo
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-ruby-devel
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-ruby-doc
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-ruby-irb
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-ruby-libs
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-ruby-tcltk
Red Hat:rhel_software_collections:2::el6
 before 0:2.2.2-12.el6
0:2.2.2-12.el6
rh-ruby22-rubygem-bigdecimal
Red Hat:rhel_software_collections:2::el6
 before 0:1.2.6-12.el6
0:1.2.6-12.el6
rh-ruby22-rubygem-io-console
Red Hat:rhel_software_collections:2::el6
 before 0:0.4.3-12.el6
0:0.4.3-12.el6
rh-ruby22-rubygem-json
Red Hat:rhel_software_collections:2::el6
 before 0:1.8.1-12.el6
0:1.8.1-12.el6
rh-ruby22-rubygem-minitest
Red Hat:rhel_software_collections:2::el6
 before 0:5.4.3-12.el6
0:5.4.3-12.el6
rh-ruby22-rubygem-power_assert
Red Hat:rhel_software_collections:2::el6
 before 0:0.2.2-12.el6
0:0.2.2-12.el6
rh-ruby22-rubygem-psych
Red Hat:rhel_software_collections:2::el6
 before 0:2.0.8-12.el6
0:2.0.8-12.el6
rh-ruby22-rubygem-rake
Red Hat:rhel_software_collections:2::el6
 before 0:10.4.2-12.el6
0:10.4.2-12.el6
rh-ruby22-rubygem-rdoc
Red Hat:rhel_software_collections:2::el6
 before 0:4.2.0-12.el6
0:4.2.0-12.el6
rh-ruby22-rubygem-test-unit
Red Hat:rhel_software_collections:2::el6
 before 0:3.0.8-12.el6
0:3.0.8-12.el6
rh-ruby22-rubygems
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.5-12.el6
0:2.4.5-12.el6
rh-ruby22-rubygems-devel
Red Hat:rhel_software_collections:2::el6
 before 0:2.4.5-12.el6
0:2.4.5-12.el6
rh-ruby22-ruby
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-ruby-debuginfo
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-ruby-devel
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-ruby-doc
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-ruby-irb
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-ruby-libs
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-ruby-tcltk
Red Hat:rhel_software_collections:2::el7
 before 0:2.2.2-12.el7
0:2.2.2-12.el7
rh-ruby22-rubygem-bigdecimal
Red Hat:rhel_software_collections:2::el7
 before 0:1.2.6-12.el7
0:1.2.6-12.el7
rh-ruby22-rubygem-io-console
Red Hat:rhel_software_collections:2::el7
 before 0:0.4.3-12.el7
0:0.4.3-12.el7
rh-ruby22-rubygem-json
Red Hat:rhel_software_collections:2::el7
 before 0:1.8.1-12.el7
0:1.8.1-12.el7
rh-ruby22-rubygem-minitest
Red Hat:rhel_software_collections:2::el7
 before 0:5.4.3-12.el7
0:5.4.3-12.el7
rh-ruby22-rubygem-power_assert
Red Hat:rhel_software_collections:2::el7
 before 0:0.2.2-12.el7
0:0.2.2-12.el7
rh-ruby22-rubygem-psych
Red Hat:rhel_software_collections:2::el7
 before 0:2.0.8-12.el7
0:2.0.8-12.el7
rh-ruby22-rubygem-rake
Red Hat:rhel_software_collections:2::el7
 before 0:10.4.2-12.el7
0:10.4.2-12.el7
rh-ruby22-rubygem-rdoc
Red Hat:rhel_software_collections:2::el7
 before 0:4.2.0-12.el7
0:4.2.0-12.el7
rh-ruby22-rubygem-test-unit
Red Hat:rhel_software_collections:2::el7
 before 0:3.0.8-12.el7
0:3.0.8-12.el7
rh-ruby22-rubygems
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.5-12.el7
0:2.4.5-12.el7
rh-ruby22-rubygems-devel
Red Hat:rhel_software_collections:2::el7
 before 0:2.4.5-12.el7
0:2.4.5-12.el7
ruby2.1
SUSE:Linux Enterprise Desktop 12 SP1
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Desktop 12 SP2
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Software Development Kit 12 SP2
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Server 12 SP1
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Server 12 SP2
 before 2.1.9-15.1
2.1.9-15.1
ruby2.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 2.1.9-15.1
2.1.9-15.1
ruby2.3
openSUSE:Tumbleweed
 before 2.3.1-1.6
2.3.1-1.6
ruby2.2
openSUSE:Tumbleweed
 before 2.2.5-1.5
2.2.5-1.5

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open