{"id":"CVE-2015-3900","aliases":["DEBIAN-CVE-2015-3900","EUVD-2022-5611","GHSA-wp3j-rvfp-624h","MGASA-2015-0345","RHSA-2015:1657","SUSE-SU-2017:1067-1","openSUSE-SU-2024:10090-1","openSUSE-SU-2024:10481-1"],"status":"published","title":"RubyGems vulnerable to DNS hijack attack","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08871,"percentile":0.95251,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-254","CWE-350"],"published":"2015-06-24T14:00:00Z","modified":"2026-09-09T06:47:20Z","fixes":[{"ecosystem":"RubyGems","package":"rubygems-update","fixed_in":["2.0.16","2.2.4","2.4.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jruby","fixed_in":["1.7.20.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jruby","fixed_in":["1.7.20.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jruby","fixed_in":["1.7.20.1-2"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"ruby-RubyGems","fixed_in":["2.1.11-3.1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"ruby-RubyGems","fixed_in":["2.1.11-5.1.mga5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-debuginfo","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-devel","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-doc","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-irb","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-libs","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-tcltk","fixed_in":["0:2.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-bigdecimal","fixed_in":["0:1.2.6-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-io-console","fixed_in":["0:0.4.3-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-json","fixed_in":["0:1.8.1-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-minitest","fixed_in":["0:5.4.3-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-power_assert","fixed_in":["0:0.2.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-psych","fixed_in":["0:2.0.8-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-rake","fixed_in":["0:10.4.2-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-rdoc","fixed_in":["0:4.2.0-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-test-unit","fixed_in":["0:3.0.8-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygems","fixed_in":["0:2.4.5-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygems-devel","fixed_in":["0:2.4.5-12.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-debuginfo","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-devel","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-doc","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-irb","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-libs","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-tcltk","fixed_in":["0:2.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-bigdecimal","fixed_in":["0:1.2.6-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-io-console","fixed_in":["0:0.4.3-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-json","fixed_in":["0:1.8.1-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-minitest","fixed_in":["0:5.4.3-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-power_assert","fixed_in":["0:0.2.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-psych","fixed_in":["0:2.0.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-rake","fixed_in":["0:10.4.2-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-rdoc","fixed_in":["0:4.2.0-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-test-unit","fixed_in":["0:3.0.8-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygems","fixed_in":["0:2.4.5-12.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygems-devel","fixed_in":["0:2.4.5-12.el7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rubygems-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.16"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rubygems-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rubygems-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.20.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.20.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.20.1-2"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rubygems-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.16"}]}],"versions":["2.0.0","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"]},{"source":"osv","ecosystem":"RubyGems","package":"rubygems-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.4"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3"]},{"source":"osv","ecosystem":"RubyGems","package":"rubygems-update","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.7"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6"]},{"source":"osv","ecosystem":"Mageia:4","package":"ruby-RubyGems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"ruby-RubyGems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-5.1.mga5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.3-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.3-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.8-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.2-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.8-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ruby22-rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-12.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-ruby-tcltk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.3-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.3-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.4.2-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.8-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-12.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ruby22-rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.5-12.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ruby2.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.9-15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby2.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1.6"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby2.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-1.5"}]}],"bundled":3}],"products":[{"vendor":"oracle","product":"solaris"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"ruby-lang","product":"ruby"},{"vendor":"rubygems","product":"rubygems"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-1657.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/06/26/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/75482","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","article"]},{"url":"https://puppet.com/security/cve/CVE-2015-3900","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3900","tags":["advisory"]},{"url":"https://web.archive.org/web/20170331091241/https://puppet.com/security/cve/CVE-2015-3900","tags":["web"]},{"url":"https://web.archive.org/web/20200228055155/http://www.securityfocus.com/bid/75482","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3900.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wp3j-rvfp-624h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3900","tags":["advisory"]},{"url":"https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0345.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16218","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1657","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1236116","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1657.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3900","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171067-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1014863","tags":["report"]},{"url":"https://bugzilla.suse.com/1018808","tags":["report"]},{"url":"https://bugzilla.suse.com/887877","tags":["report"]},{"url":"https://bugzilla.suse.com/909695","tags":["report"]},{"url":"https://bugzilla.suse.com/926974","tags":["report"]},{"url":"https://bugzilla.suse.com/936032","tags":["report"]},{"url":"https://bugzilla.suse.com/959495","tags":["report"]},{"url":"https://bugzilla.suse.com/986630","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2339","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-3900","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2015-06-24T14:00:00Z","modified":"2024-08-06T05:56:16.332Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2022-5611","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2015-06-24T14:00:00Z","modified":"2024-08-06T05:56:16Z","updated_at":"2026-11-03T02:22:06.212182Z"}],"ghsa":[{"id":"GHSA-wp3j-rvfp-624h","title":"RubyGems vulnerable to DNS hijack attack","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2022-05-14T01:08:49Z","modified":"2023-08-25T22:31:50Z","cwes":["CWE-350"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2015-3900","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2015-06-24T14:59:01.19Z","modified":"2026-06-17T00:26:28.26Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-254"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"CVE-2015-3900","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2015-06-24T14:59:01Z","modified":"2026-04-16T06:16:19.787792045Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3900","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2015-06-24T14:59:01.19Z","modified":"2026-09-09T06:47:20.353708626Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-wp3j-rvfp-624h","title":"RubyGems vulnerable to DNS hijack attack","description":"RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a \"DNS hijack attack.\"","status":"published","published":"2022-05-14T01:08:49Z","modified":"2024-11-30T05:39:08.392749Z","cwes":["CWE-350"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"MGASA-2015-0345","title":"Updated ruby-RubyGems packages fix security vulnerabilities","description":"Updated ruby-RubyGems package fixes security vulnerability:\n\nRubyGems does not validate the hostname when fetching gems or making API\nrequest, which allows remote attackers to redirect requests to arbitrary\ndomains via a crafted DNS SRV record, aka a \"DNS hijack attack\"\n(CVE-2015-3900).\n","status":"published","published":"2015-09-08T17:55:59Z","modified":"2026-04-16T06:24:01.828007415Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10090-1","title":"libruby2_3-2_3-2.3.1-1.6 on GA media","description":"These are all security issues fixed in the libruby2_3-2_3-2.3.1-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:15:31.064709Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10481-1","title":"libruby2_2-2_2-2.2.5-1.5 on GA media","description":"These are all security issues fixed in the libruby2_2-2_2-2.2.5-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:04:09.674731Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2015:1657","title":"Red Hat Security Advisory: rh-ruby22-ruby security update","status":"published","published":"2024-09-13T10:37:07Z","modified":"2026-06-29T10:09:58Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2017:1067-1","title":"Security update for ruby2.1","description":"\nThis ruby2.1 update to version 2.1.9 fixes the following issues:\n\nSecurity issues fixed:\n- CVE-2016-2339: heap overflow vulnerability in the Fiddle::Function.new'initialize' (bsc#1018808)\n- CVE-2015-7551: Unsafe tainted string usage in Fiddle and DL (bsc#959495)\n- CVE-2015-3900: hostname validation does not work when fetching gems or making API requests (bsc#936032)\n- CVE-2015-1855: Ruby'a OpenSSL extension suffers a vulnerability through overly permissive matching of\n  hostnames (bsc#926974)\n- CVE-2014-4975: off-by-one stack-based buffer overflow in the encodes() function (bsc#887877)\n\nBugfixes:\n- SUSEconnect doesn't handle domain wildcards in no_proxy environment variable properly (bsc#1014863)\n- Segmentation fault after pack \u0026 ioctl \u0026 unpack (bsc#909695)\n- Ruby:HTTP Header injection in 'net/http' (bsc#986630)\n\nChangeLog:\n- http://svn.ruby-lang.org/repos/ruby/tags/v2_1_9/ChangeLog\n","status":"published","published":"2017-04-20T06:35:59Z","modified":"2026-02-04T04:00:33.439608Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}