Input validation error in Ruby - CVE-2015-4020
Published: August 25, 2015 / Updated: July 28, 2020
Vulnerability identifier: #VU32366
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-4020
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Affected software
Ruby
Amazon Linux AMI
ruby (Alpine package)
Amazon Linux AMI
ruby (Alpine package)
How to mitigate CVE-2015-4020
Install update from vendor's website.
Ruby - addressed in versions 2.2.5, 2.4.8
ruby (Alpine package) - update to 2.2.3-r0
ruby (Alpine package) - update to 2.2.3-r0
External References
- http://blog.rubygems.org/2015/06/08/2.2.5-released.html
- http://blog.rubygems.org/2015/06/08/2.4.8-released.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/75431
- https://github.com/rubygems/rubygems/commit/5c7bfb5
- https://puppet.com/security/cve/CVE-2015-3900
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/