Skip to content
OpenAdvisories
Unscored RHSA-2015:1657 1 CVE

Red Hat Security Advisory: rh-ruby22-ruby security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 36

ReleasePackageFixed in
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby-debuginfo 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby-devel 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby-doc 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby-irb 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby-libs 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-ruby-tcltk 0:2.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-bigdecimal 0:1.2.6-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-io-console 0:0.4.3-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-json 0:1.8.1-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-minitest 0:5.4.3-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-power_assert 0:0.2.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-psych 0:2.0.8-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-rake 0:10.4.2-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-rdoc 0:4.2.0-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygem-test-unit 0:3.0.8-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygems 0:2.4.5-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ruby22-rubygems-devel 0:2.4.5-12.el6
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby-debuginfo 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby-devel 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby-doc 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby-irb 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby-libs 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-ruby-tcltk 0:2.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-bigdecimal 0:1.2.6-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-io-console 0:0.4.3-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-json 0:1.8.1-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-minitest 0:5.4.3-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-power_assert 0:0.2.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-psych 0:2.0.8-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-rake 0:10.4.2-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-rdoc 0:4.2.0-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygem-test-unit 0:3.0.8-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygems 0:2.4.5-12.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ruby22-rubygems-devel 0:2.4.5-12.el7

Vulnerabilities 1

  • High —
    CVE-2015-3900

    RubyGems vulnerable to DNS hijack attack

    RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS…

    jruby rubygems-update Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1236116
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1657.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-3900
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-3900
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-3900
  • article
    http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html