Description
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rbovirt | < 0.0.24 | 0.0.24 | GHSA-ww79-8xwv-932x |
References
- FEDORA-2014-3573 vendor-advisory
- FEDORA-2014-3526 vendor-advisory
- [oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1058595