Description

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Remediation

References

CVE-2015-3900

Related Vulnerabilities

WebLogic CVE-2020-14882 Vulnerability (CVE-2020-14882)

WordPress Plugin WordPress Landing Page-Squeeze Page-Responsive Landing Page Builder Free-WP Lead Plus X Multiple Vulnerabilities (0.98)

WordPress Plugin FormCraft-Premium WordPress Form Builder Cross-Site Scripting (3.2.31)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-6832)

WordPress Plugin WP-Property-WordPress Powered Real Estate and Property Management SQL Injection (1.36.0)

Severity

Medium

Classification

CVE-2015-3900

Tags

Missing Update Known Vulnerabilities