Red Hat Security Advisory: rubygems security update

Fixed packages 1

Vulnerabilities 2

• Medium —
  CVE-2012-2125

  RubyGems HTTPS to HTTP redirect

  RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.

  jruby rubygems rubygems-update Debian Ubuntu RubyGems
  Oct 1, 2013
• Medium —
  CVE-2012-2126

  RubyGems does not verify SSL certificate

  RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.

  jruby rubygems rubygems-update Debian Ubuntu RubyGems
  Oct 1, 2013

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=814718
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1203.json
• report
  https://access.redhat.com/security/cve/CVE-2012-2125
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-2125
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-2125
• report
  https://access.redhat.com/security/cve/CVE-2012-2126
• advisory
  https://www.cve.org/CVERecord?id=CVE-2012-2126
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2012-2126