PT-2015-6389 · Ruby · Rubygems

Published 2015-08-25 · Updated 2025-09-29 · CVE-2015-4020

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions RubyGems versions 2.0.x through 2.0.16 RubyGems versions 2.2.x through 2.2.4 RubyGems versions 2.3.x through 2.4.7

Description The issue allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, also known as a "DNS hijack attack". This occurs because RubyGems does not validate the hostname when fetching gems or making API requests.

Recommendations For RubyGems versions 2.0.x through 2.0.16, update to version 2.0.17 or later. For RubyGems versions 2.2.x through 2.2.4, update to version 2.2.5 or later. For RubyGems versions 2.3.x through 2.4.7, update to version 2.4.8 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2025_16880

CVE-2015-4020

GHSA-QV62-XFJ6-32XM

Affected Products

Rubygems

References · 14

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-4020.yml · Exploit
• http://blog.rubygems.org/2015/06/08/2.2.5-released.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-4020 · Security Note
• http://blog.rubygems.org/2015/06/08/2.4.8-released.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qv62-xfj6-32xm · Vendor Advisory
• https://github.com/rubygems/rubygems · Note
• https://github.com/rubygems/rubygems/commit/5c7bfb5 · Note
• http://securityfocus.com/bid/75431 · Note
• https://puppet.com/security/cve/CVE-2015-3900 · Note
• http://oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html · Note
• https://trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900 · Note
• https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478 · Note
• https://web.archive.org/web/20200228085830/https://puppet.com/security/cve/CVE-2015-3900 · Note
• https://web.archive.org/web/20200228084212/http://securityfocus.com/bid/75431 · Note