{"action":"Upgrade rubygems-update to 2.0.17 or later.","affected":[{"fixed":"2.0.17","introduced":"0"},{"fixed":"2.2.5","introduced":"2.1.0.rc.1"},{"fixed":"2.4.8","introduced":"2.3.0"}],"component":"rubygems-update","cve_ids":["CVE-2015-4020"],"ecosystem":"RubyGems","epss":0.03461,"exploited":false,"fixed_versions":["2.0.17","2.2.5","2.4.8"],"ghsa_id":"GHSA-qv62-xfj6-32xm","id":"tcs_01M5KEN2XY0N6E73BNKR4YA0W9","modified_at":"2024-12-02T05:50:33.753196Z","published_at":"2022-05-17T00:16:50Z","references":["https://osv.dev/vulnerability/GHSA-qv62-xfj6-32xm","https://nvd.nist.gov/vuln/detail/CVE-2015-4020","https://github.com/rubygems/rubygems/commit/5c7bfb5","https://github.com/rubygems/rubygems","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-4020.yml","https://puppet.com/security/cve/CVE-2015-3900","https://web.archive.org/web/20200228084212/http://www.securityfocus.com/bid/75431","https://web.archive.org/web/20200228085830/https://puppet.com/security/cve/CVE-2015-3900","https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478","https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900","http://blog.rubygems.org/2015/06/08/2.2.5-released.html","http://blog.rubygems.org/2015/06/08/2.4.8-released.html","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","http://www.securityfocus.com/bid/75431"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-qv62-xfj6-32xm","url":"https://osv.dev/vulnerability/GHSA-qv62-xfj6-32xm"}],"summary":"RubyGems Improper Input Validation vulnerability"}