Description
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rubygems | 1.8.24-1 | — |
| Debian 13 | rubygems | 1.8.24-1 | — |
| Debian 12 | rubygems | 1.8.24-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | jruby | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | rubygems | 1.3.7-4.el6_4 | RHSA-2013:1441 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | rubygems | 1.8.24-4.el6op | RHSA-2013:1203 |
| Red Hat MRG 2 | cumin | 0.1.5787-4.el6 | RHSA-2013:1852 |
| Red Hat MRG 2 | rubygems | 1.8.23.2-1.el6 | RHSA-2013:1852 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rubygems-update | < 1.8.23 | 1.8.23 | GHSA-228f-g3h7-3fj3 |
Advisories 3
- RHSA-2013:1852 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.4 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1441 Red Hat Security Advisory: rubygems security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:1203 Red Hat Security Advisory: rubygems security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- 55381 third-party-advisory
- USN-1582-1 vendor-advisory
- https://github.com/rubygems/rubygems/blob/1.8/History.txt
- RHSA-2013:1203 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=814718
- [oss-security] 20120420 Re: CVE Request -- rubygems: Two security fixes in upstream v1.8.23 version mailing-list
- RHSA-2013:1852 vendor-advisory
- RHSA-2013:1441 vendor-advisory