{"id":"CVE-2014-0036","aliases":["EUVD-2017-0325","GHSA-ww79-8xwv-932x"],"status":"published","title":"rbovirt uses the rest-client gem with SSL verification disabled","description":"The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01968,"percentile":0.80521,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-04-17T14:00:00Z","modified":"2026-06-17T00:02:08Z","fixes":[{"ecosystem":"RubyGems","package":"rbovirt","fixed_in":["0.0.24"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rbovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.24"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rbovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.24"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.20","0.0.21","0.0.22","0.0.23","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9"]}],"products":[{"vendor":"amos_benari","product":"rbovirt"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130148.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130180.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://seclists.org/oss-sec/2014/q1/509","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1058595","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0036","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rbovirt/CVE-2014-0036.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ww79-8xwv-932x"},{"url":"https://github.com/abenari/rbovirt","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2014-0036","description":"The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.","status":"published","published":"2014-04-17T14:00:00Z","modified":"2024-08-06T08:58:26.516Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2017-0325","description":"The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.","status":"published","published":"2014-04-17T14:00:00Z","modified":"2024-08-06T08:58:26Z","updated_at":"2026-11-03T01:57:22.992Z"}],"ghsa":[{"id":"GHSA-ww79-8xwv-932x","title":"rbovirt uses the rest-client gem with SSL verification disabled","description":"The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-04T05:05:11Z","updated_at":"2026-11-02T14:37:12.407027Z"}],"nvd":[{"id":"CVE-2014-0036","description":"The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.","status":"published","published":"2014-04-17T14:55:06.23Z","modified":"2026-06-17T00:02:08.043Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-ww79-8xwv-932x","title":"rbovirt uses the rest-client gem with SSL verification disabled","description":"The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-12-03T06:07:55.24602Z","updated_at":"2026-11-02T15:46:59.131095Z"}]}}