Executive Summary
| Summary | |
|---|---|
| Title | rh-ruby22-ruby security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2015:1657 | First vendor Publication | 2015-08-24 |
| Vendor | RedHat | Last vendor Modification | 2015-08-24 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated rh-ruby22-ruby packages that fix one security issue are now available for Red Hat Software Collections 2. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. A flaw was found in a way rubygems verified the API endpoint hostname retrieved through a DNS SRV record. A man-in-the-middle attacker could use this flaw to force a client to download content from an untrusted domain. (CVE-2015-3900) All rh-ruby22-ruby users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running instances of Ruby need to be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1236116 - CVE-2015-3900 rubygems: DNS hijacking vulnerability in api_endpoint() |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2015-1657.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-254 | Security Features |
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1050.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2017-1051.nasl - Type : ACT_GATHER_INFO |
| 2017-05-01 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2017-527.nasl - Type : ACT_GATHER_INFO |
| 2017-04-21 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-1067-1.nasl - Type : ACT_GATHER_INFO |
| 2015-08-20 | Name : The remote Fedora host is missing a security update. File : fedora_2015-13157.nasl - Type : ACT_GATHER_INFO |
| 2015-08-11 | Name : The remote Fedora host is missing a security update. File : fedora_2015-12501.nasl - Type : ACT_GATHER_INFO |
| 2015-08-11 | Name : The remote Fedora host is missing a security update. File : fedora_2015-12574.nasl - Type : ACT_GATHER_INFO |
| 2015-07-23 | Name : A web application on the remote host is affected by multiple vulnerabilities. File : puppet_enterprise_cve_2015-4100.nasl - Type : ACT_GATHER_INFO |
| 2015-06-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-547.nasl - Type : ACT_GATHER_INFO |
| 2015-06-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-548.nasl - Type : ACT_GATHER_INFO |
| 2015-06-18 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-549.nasl - Type : ACT_GATHER_INFO |
| 2015-05-18 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_a0089e18fc9e11e4bc58001e67150279.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2015-08-24 21:27:40 |
|
