CVE-2015-3900

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-06-24 · updated 2026-06-17
Weakness: CWE-254

Description

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."

Affected products

Oracle Corporation Solaris Operating System: 11.3
Red Hat Enterprise Linux: 6.0, 7.0
Ruby: 1.9, 1.9.1, 1.9.2, 1.9.3, 2.0.0, 2.1 (+6)
rubygems: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5 (+21)

References

http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164236.html
http://rhn.redhat.com/errata/RHSA-2015-1657.html
http://www.openwall.com/lists/oss-security/2015/06/26/2
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.securityfocus.com/bid/75482
https://puppet.com/security/cve/CVE-2015-3900
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/
http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html

Get alerted when CVE-2015-3900 or the next vulnerability affects your stack