GHSA-73w7-6w9g-gc8w

Source

https://github.com/advisories/GHSA-73w7-6w9g-gc8w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-73w7-6w9g-gc8w/GHSA-73w7-6w9g-gc8w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-73w7-6w9g-gc8w

Aliases

CVE-2017-0902

Published

2022-05-13T01:38:25Z

Modified

2024-02-22T05:34:32.603978Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

RubyGems has Origin Validation Error vulnerability

Details

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

Database specific

{
    "nvd_published_at": "2017-08-31T20:29:00Z",
    "cwe_ids": [
        "CWE-346",
        "CWE-350"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-09T00:36:26Z"
}

References

Affected packages

RubyGems / rubygems-update

Package

Name: rubygems-update
Purl: pkg:gem/rubygems-update

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.13

Affected versions

0.*

0.8.3

0.8.4

0.8.5

0.8.6

0.8.8

0.8.10

0.8.11

0.9.0

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

1.*

1.0.0

1.0.1

1.1.0

1.1.1

1.2.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.4.0

1.4.1

1.4.2

1.5.0

1.5.2

1.5.3

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

1.7.2

1.8.0

1.8.1

1.8.2

1.8.3

1.8.4

1.8.5

1.8.6

1.8.7

1.8.8

1.8.9

1.8.10

1.8.11

1.8.12

1.8.13

1.8.14

1.8.15

1.8.16

1.8.17

1.8.18

1.8.19

1.8.20

1.8.21

1.8.22

1.8.23

1.8.23.2

1.8.24

1.8.25

1.8.26

1.8.27

1.8.28

1.8.29

1.8.30

2.*

2.0.0.preview2

2.0.0.preview2.1

2.0.0.preview2.2

2.0.0.rc.1

2.0.0.rc.2

2.0.0

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.1.0.rc.1

2.1.0.rc.2

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.2.0.rc.1

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.3.0

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.5.0

2.5.1

2.5.2

2.6.0

2.6.1

2.6.2

2.6.3

2.6.4

2.6.5

2.6.6

2.6.7

2.6.8

2.6.9

2.6.10

2.6.11

2.6.12