[RHSA-2013:1441] rubygems security update
RubyGems is the Ruby standard for publishing and managing third-party
libraries.
It was found that RubyGems did not verify SSL connections. This could lead
to man-in-the-middle attacks. (CVE-2012-2126)
It was found that, when using RubyGems, the connection could be redirected
from HTTPS to HTTP. This could lead to a user believing they are installing
a gem via HTTPS, when the connection may have been silently downgraded to
HTTP. (CVE-2012-2125)
It was discovered that the rubygems API validated version strings using an
unsafe regular expression. An application making use of this API to process
a version string from an untrusted source could be vulnerable to a denial
of service attack through CPU exhaustion. (CVE-2013-4287)
Red Hat would like to thank Rubygems upstream for reporting CVE-2013-4287.
Upstream acknowledges Damir Sharipov as the original reporter.
All rubygems users are advised to upgrade to this updated package, which
contains backported patches to correct these issues.
Package | Affected Version |
---|---|
pkg:rpm/redhat/rubygems?distro=redhat-6.4 | < 1.3.7-4.el6_4 |
- ID
- RHSA-2013:1441
- Severity
- moderate
- URL
- https://access.redhat.com/errata/RHSA-2013:1441
- Published
-
2013-10-17T00:00:00
(11 years ago) - Modified
-
2013-10-17T00:00:00
(11 years ago) - Rights
- Copyright 2013 Red Hat, Inc.
- Other Advisories
-
- ALAS-2012-79
- ALAS-2013-230
- ELSA-2013-1441
- FEDORA-2012-6132
- FEDORA-2012-6409
- FEDORA-2012-6414
- FEDORA-2013-16251
- FEDORA-2013-16316
- FEDORA-2013-16376
- FEDORA-2013-17649
- FEDORA-2013-17662
- FREEBSD:54237182-9635-4A8B-92D7-33BFAEED84CD
- RUBYSEC:RUBYGEMS-UPDATE-2012-2125
- RUBYSEC:RUBYGEMS-UPDATE-2012-2126
- RUBYSEC:RUBYGEMS-UPDATE-2013-4287
- USN-1582-1
- USN-1583-1
Source | # ID | Name | URL |
---|---|---|---|
Bugzilla | 814718 | https://bugzilla.redhat.com/814718 | |
Bugzilla | 1002364 | https://bugzilla.redhat.com/1002364 | |
RHSA | RHSA-2013:1441 | https://access.redhat.com/errata/RHSA-2013:1441 | |
CVE | CVE-2012-2125 | https://access.redhat.com/security/cve/CVE-2012-2125 | |
CVE | CVE-2012-2126 | https://access.redhat.com/security/cve/CVE-2012-2126 | |
CVE | CVE-2013-4287 | https://access.redhat.com/security/cve/CVE-2013-4287 |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/redhat/rubygems?distro=redhat-6.4 | redhat | rubygems | < 1.3.7-4.el6_4 | redhat-6.4 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |