GCVE - cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*

part: a version: 2.4.1 update: *

Vendor	Rubygems (`5347428e-e8c8-57fc-9684-11fb386ba37c`)
Product	Rubygems (`71142bdc-898b-5262-af64-3aa5698c056b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ruby-rubygems`	purl2cpe	2026-06-01 10:18:08.567816
`pkg:deb/ubuntu/ruby-rubygems`	purl2cpe	2026-06-01 10:18:08.567818
`pkg:gem/rubygems`	purl2cpe	2026-06-01 10:18:08.567819
`pkg:github/rubygems/rubygems`	purl2cpe	2026-06-01 10:18:08.567820
`pkg:rpm/fedora/rubygems`	purl2cpe	2026-06-01 10:18:08.567822
`pkg:rpm/opensuse/rubygems`	purl2cpe	2026-06-01 10:18:08.567823

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-0903`	vulnerable	2026-06-08 05:08:26.867963	Details available RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. Published: 2017-10-11T18:00:00.000Z Updated: 2024-09-17T03:54:57.184Z Open on db.gcve.eu Reference links https://usn.ubuntu.com/3685-1/ https://usn.ubuntu.com/3553-1/ https://access.redhat.com/errata/RHSA-2018:0585 https://access.redhat.com/errata/RHSA-2018:0378 https://hackerone.com/reports/274990	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-4020`	vulnerable	2026-06-08 05:06:39.012619	Details available RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900. Published: 2015-08-25T17:00:00.000Z Updated: 2024-08-06T06:04:02.680Z Open on db.gcve.eu Reference links http://blog.rubygems.org/2015/06/08/2.2.5-released.html https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/ http://www.securityfocus.com/bid/75431 https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478 http://blog.rubygems.org/2015/06/08/2.4.8-released.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3900`	vulnerable	2026-06-08 05:06:38.735136	Details available RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." Published: 2015-06-24T14:00:00.000Z Updated: 2024-08-06T05:56:16.332Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1657.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html http://www.openwall.com/lists/oss-security/2015/06/26/2 https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.