PT-2015-6338 · Ruby+2 · Rubygems+2

Jonathan Claudius · Published 2015-06-24 · Updated 2025-09-29 · CVE-2015-3900

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.0.x through 2.0.16 RubyGems versions 2.2.x through 2.2.4 RubyGems versions 2.4.x through 2.4.7

Description The issue allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, which is referred to as a "DNS hijack attack." This occurs because the hostname is not validated when fetching gems or making API requests.

Recommendations For RubyGems versions 2.0.x through 2.0.16, update to version 2.0.16 or later. For RubyGems versions 2.2.x through 2.2.4, update to version 2.2.4 or later. For RubyGems versions 2.4.x through 2.4.7, update to version 2.4.7 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-350

CWE-254

CWE-20

Related Identifiers

ALSA-2025_16880

ALT-PU-2016-2061

CVE-2015-3900

GHSA-QV62-XFJ6-32XM

GHSA-WP3J-RVFP-624H

MGASA-2015-0345

OPENSUSE-SU-2017_1128-1

OPENSUSE-SU-2024:10090-1

OPENSUSE-SU-2024:10481-1

RHSA-2015:1657

SUSE-SU-2017:1067-1

Affected Products

Alt Linux

Rubygems

Suse

References · 51

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3900.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-4020.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-3900 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0345.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10090-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4020 · Security Note
• http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-3900 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3900 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10481-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qv62-xfj6-32xm · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1657.html · Vendor Advisory