Search for packages
| purl | pkg:gem/rubygems-update@2.1 |
| Tags | Ghost |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-w37m-8kzy-kydq
Aliases: CVE-2013-4287 GHSA-9j7m-rjqx-48vh OSV-97163 |
RubyGems Regular Expression Denial of Service vulnerability Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. |
Affected by 8 other vulnerabilities. |
|
VCID-wve4-sjev-euge
Aliases: CVE-2015-3900 GHSA-wp3j-rvfp-624h OSV-122162 |
RubyGems vulnerable to DNS hijack attack RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." |
Affected by 7 other vulnerabilities. Affected by 13 other vulnerabilities. |
|
VCID-zp1b-4nku-y7ht
Aliases: CVE-2015-4020 GHSA-qv62-xfj6-32xm |
RubyGems Improper Input Validation vulnerability RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900. |
Affected by 7 other vulnerabilities. Affected by 12 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-07-01T16:58:27.048908+00:00 | Ruby Importer | Affected by | VCID-zp1b-4nku-y7ht | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-4020.yml | 36.1.3 |
| 2025-07-01T16:58:26.890982+00:00 | Ruby Importer | Affected by | VCID-w37m-8kzy-kydq | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2013-4287.yml | 36.1.3 |
| 2025-07-01T16:58:26.838586+00:00 | Ruby Importer | Affected by | VCID-wve4-sjev-euge | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2015-3900.yml | 36.1.3 |