RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Jun 24, 2015 |
| Debian | — | Upgrade jruby | Jul 30, 2024 | Jun 24, 2015 |
| Freebsd | — | Upgrade ruby20-gemsUpgrade ruby22-gemsUpgrade ruby21-gems | Dec 10, 2025 | May 17, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rubygem-psychUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade ruby-irbUpgrade rubygem-jsonUpgrade ruby-libsUpgrade rubyUpgrade rubygemsUpgrade rubygem-rdoc | Nov 30, 2017 | Jun 24, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade rubyUpgrade ruby-irb | Nov 30, 2017 | Jun 24, 2015 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3 | May 29, 2017 | Jun 24, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 14, 2015 |
| Suse | — | Upgrade ruby2.1Upgrade libruby2_1-2_1Upgrade ruby2.1-stdlibUpgrade ruby2.1-devel | Apr 5, 2017 | Jun 24, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub