Skip to content
OpenAdvisories
Unscored RHSA-2013:1852 7 CVEs

Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.4 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · MRG 2 enterprise_mrg:2:computenode:el6 rubygems 0:1.8.23.2-1.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 cumin 0:0.1.5787-4.el6
Red Hat · MRG 2 enterprise_mrg:2:server:el6 rubygems 0:1.8.23.2-1.el6

Vulnerabilities 7

  • Medium —
    CVE-2012-2125

    RubyGems HTTPS to HTTP redirect

    RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.

    jruby rubygems rubygems-update Debian Ubuntu RubyGems
  • Medium —
    CVE-2012-2126

    RubyGems does not verify SSL certificate

    RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.

    jruby rubygems rubygems-update Debian Ubuntu RubyGems
  • Medium —
    CVE-2013-4287

    RubyGems Regular Expression Denial of Service vulnerability

    Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers t…

    rubygems rubygems-update Debian RubyGems
  • Unscored —
    CVE-2013-4404

    cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users …

  • Unscored —
    CVE-2013-4405

    Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Gri…

  • Unscored —
    CVE-2013-4414

    Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remot…

  • Unscored —
    CVE-2013-4461

    SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers t…

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=814718
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=995038
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=998561
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=998606
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1002364
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1016263
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1852.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-2125
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-2125
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-2125
  • report
    https://access.redhat.com/security/cve/CVE-2012-2126
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-2126
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-2126
  • report
    https://access.redhat.com/security/cve/CVE-2013-4287
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4287
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4287
  • article
    http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html
  • report
    https://access.redhat.com/security/cve/CVE-2013-4404
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4404
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4404
  • report
    https://access.redhat.com/security/cve/CVE-2013-4405
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4405
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4405
  • report
    https://access.redhat.com/security/cve/CVE-2013-4414
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4414
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4414
  • report
    https://access.redhat.com/security/cve/CVE-2013-4461
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4461
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4461