Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
RubyGems Improper Input Validation Vulnerability - CVE-2015-4020 - Vulnerability Database
RubyGems

RubyGems Improper Input Validation Vulnerability - CVE-2015-4020

Medium
Reference: CVE-2015-4020
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2015-4020
Title: RubyGems Improper Input Validation Vulnerability
Overview:

RubyGems 2.0.x before 2.0.17 2.2.x before 2.2.5 and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name aka a quotDNS hijack attack.quot NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.