CVE-2015-3900

RubyGems/rubygems-update CVE-2015-3900: high

RubyGems vulnerable to DNS hijack attack

Action: Upgrade rubygems-update to 2.0.16 or later.

bundle update rubygems-update

Affected

Fixed versions

Sources

• osv: GHSA-wp3j-rvfp-624h
• https://nvd.nist.gov/vuln/detail/CVE-2015-3900
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3900.yml
• https://puppet.com/security/cve/CVE-2015-3900
• https://web.archive.org/web/20170331091241/https://puppet.com/security/cve/CVE-2015-3900
• https://web.archive.org/web/20200228055155/http://www.securityfocus.com/bid/75482
• https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
• https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900
• http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html
• http://rhn.redhat.com/errata/RHSA-2015-1657.html
• http://www.openwall.com/lists/oss-security/2015/06/26/2
• http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

CVE-2015-3900 · published 2022-05-14T01:08:49Z · modified 2024-11-30T05:39:08.392749Z · JSON