Description
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jruby | 1.7.20.1-2 | — |
| Debian 13 | jruby | 1.7.20.1-2 | — |
| Debian 12 | jruby | 1.7.20.1-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | rh-ruby22-ruby +5 | 2.2.2-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-bigdecimal | 1.2.6-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-io-console | 0.4.3-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-json | 1.8.1-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-minitest | 5.4.3-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-power_assert | 0.2.2-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-psych | 2.0.8-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-rake | 10.4.2-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-rdoc | 4.2.0-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygem-test-unit | 3.0.8-12.el6 | RHSA-2015:1657 |
| RHEL 2 | rh-ruby22-rubygems +1 | 2.4.5-12.el6 | RHSA-2015:1657 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2017:1067-1 |
| SLES 12 SP1 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2017:1067-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2017:1067-1 |
| SLES for SAP 12 SP1 | ruby2.1 | 2.1.9-15.1 | SUSE-SU-2017:1067-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby2.2 | 2.2.5-1.5 | openSUSE-SU-2024:10481-1 |
| openSUSE Tumbleweed | ruby2.3 | 2.3.1-1.6 | openSUSE-SU-2024:10090-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rubygems-update | >= 2.0.0, < 2.0.16 | 2.0.16 | GHSA-wp3j-rvfp-624h |
| RubyGems | rubygems-update | >= 2.2.0, < 2.2.4 | 2.2.4 | GHSA-wp3j-rvfp-624h |
| RubyGems | rubygems-update | >= 2.4.0, < 2.4.7 | 2.4.7 | GHSA-wp3j-rvfp-624h |
Advisories 4
- RHSA-2015:1657 Red Hat Security Advisory: rh-ruby22-ruby security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10090-1 libruby2_3-2_3-2.3.1-1.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1067-1 Security update for ruby2.1 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10481-1 libruby2_2-2_2-2.2.5-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2015:1657 vendor-advisory
- FEDORA-2015-12501 vendor-advisory
- FEDORA-2015-12574 vendor-advisory
- [oss-security] 20150626 rubygems <2.4.8 vulnerable to DNS request hijacking (CVE-2015-3900 and CVE-2015-4020) mailing-list
- https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/
- 75482 vdb-entry
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-007/?fid=6356
- http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html
- https://puppet.com/security/cve/CVE-2015-3900
- FEDORA-2015-13157 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html