CVE-2012-2125: Medium severity rubygems vulnerability
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Other sources
Two security flaws were corrected in upstream rubygems v1.8.23 version: #1 RubyGems now disallows redirection from HTTPS to HTTP, #2 RubyGems now verifies SSL connections.
References: [1] https://github.com/rubygems/rubygems/blob/1.8/History.txt
Upstream patch: [2] https://github.com/rubygems/rubygems/commit/d4c7eafb8efe1e13a7abf5be5a5b4548870b15b7
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2012-2125?
CVE-2012-2125 has been classified as a medium severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2012-2125?
To fix CVE-2012-2125, update RubyGems to version 1.8.23 or later.
What type of vulnerability is CVE-2012-2125?
CVE-2012-2125 is a security vulnerability that allows redirects from HTTPS to HTTP, which may enable interception of gem installations.
Which versions of RubyGems are affected by CVE-2012-2125?
RubyGems versions before 1.8.23 are affected by CVE-2012-2125.
Can CVE-2012-2125 lead to data compromise?
Yes, CVE-2012-2125 can lead to data compromise through unauthorized observation or modification of gems during installation.