{"action":"Upgrade rubygems-update to 2.0.16 or later.","affected":[{"fixed":"2.0.16","introduced":"2.0.0"},{"fixed":"2.2.4","introduced":"2.2.0"},{"fixed":"2.4.7","introduced":"2.4.0"}],"component":"rubygems-update","cve_ids":["CVE-2015-3900"],"ecosystem":"RubyGems","epss":0.08871,"exploited":false,"fixed_versions":["2.0.16","2.2.4","2.4.7"],"ghsa_id":"GHSA-wp3j-rvfp-624h","id":"tcs_01M5KENZT14FWE43164M58151S","modified_at":"2024-11-30T05:39:08.392749Z","published_at":"2022-05-14T01:08:49Z","references":["https://osv.dev/vulnerability/GHSA-wp3j-rvfp-624h","https://nvd.nist.gov/vuln/detail/CVE-2015-3900","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3900.yml","https://puppet.com/security/cve/CVE-2015-3900","https://web.archive.org/web/20170331091241/https://puppet.com/security/cve/CVE-2015-3900","https://web.archive.org/web/20200228055155/http://www.securityfocus.com/bid/75482","https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356","https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900","http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html","http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html","http://rhn.redhat.com/errata/RHSA-2015-1657.html","http://www.openwall.com/lists/oss-security/2015/06/26/2","http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-wp3j-rvfp-624h","url":"https://osv.dev/vulnerability/GHSA-wp3j-rvfp-624h"}],"summary":"RubyGems vulnerable to DNS hijack attack"}