Skip to content
OpenAdvisories
Unscored RHSA-2013:1441 3 CVEs

Red Hat Security Advisory: rubygems security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 4

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client rubygems 0:1.3.7-4.el6_4
Red Hat · RHEL 6 enterprise_linux:6::computenode rubygems 0:1.3.7-4.el6_4
Red Hat · RHEL 6 enterprise_linux:6::server rubygems 0:1.3.7-4.el6_4
Red Hat · RHEL 6 enterprise_linux:6::workstation rubygems 0:1.3.7-4.el6_4

Vulnerabilities 3

  • Medium —
    CVE-2012-2125

    RubyGems HTTPS to HTTP redirect

    RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.

    jruby rubygems rubygems-update Debian Ubuntu RubyGems
  • Medium —
    CVE-2012-2126

    RubyGems does not verify SSL certificate

    RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.

    jruby rubygems rubygems-update Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-4287

    RubyGems Regular Expression Denial of Service vulnerability

    Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers t…

    rubygems rubygems-update Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=814718
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1002364
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1441.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-2125
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-2125
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-2125
  • report
    https://access.redhat.com/security/cve/CVE-2012-2126
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-2126
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-2126
  • report
    https://access.redhat.com/security/cve/CVE-2013-4287
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4287
  • article
    http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html