The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ruby | Aug 30, 2017 | Jun 24, 2015 |
| Debian | — | Upgrade jruby | Jul 30, 2024 | Jun 24, 2015 |
| Freebsd | — | Upgrade ruby21-gemsUpgrade ruby22-gemsUpgrade ruby20-gems | Dec 10, 2025 | May 17, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade rubygem-io-consoleUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby-irbUpgrade rubyUpgrade rubygemsUpgrade rubygem-rdoc | Nov 30, 2017 | Jun 24, 2015 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ruby-libsUpgrade ruby-irbUpgrade ruby | Nov 30, 2017 | Jun 24, 2015 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3 | May 29, 2017 | Jun 24, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 14, 2015 |
| Suse | — | Upgrade ruby2.1-stdlibUpgrade libruby2_1-2_1Upgrade ruby2.1Upgrade ruby2.1-devel | Apr 5, 2017 | Jun 24, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub