RHSA-2013:1203: Moderate: rubygems security update
RubyGems is the Ruby standard for publishing and managing third-partylibraries.It was found that, when using RubyGems, the connection could be redirectedfrom HTTPS to HTTP. This could lead to a user believing they are installinga gem via HTTPS, when the connection may have been silently downgraded toHTTP. (CVE-2012-2125)It was found that RubyGems did not verify SSL connections. This could leadto man-in-the-middle attacks. (CVE-2012-2126)All users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade tothis updated package, which corrects these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2013:1203?
The severity of RHSA-2013:1203 is classified as moderate.
How do I fix RHSA-2013:1203?
You can fix RHSA-2013:1203 by updating RubyGems to version 1.8.24-4.el6 or higher.
What causes the vulnerability in RHSA-2013:1203?
The vulnerability in RHSA-2013:1203 is caused by the potential for redirection from HTTPS to HTTP during gem installation.
Which versions of RubyGems are affected by RHSA-2013:1203?
RHSA-2013:1203 affects versions of RubyGems prior to 1.8.24-4.el6.
Is there a risk of data compromise with RHSA-2013:1203?
Yes, RHSA-2013:1203 poses a risk of data compromise as it may mislead users into believing they are securely installing gems.