GCVE - cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*

part: a version: 2.0.3 update: *

Vendor	Rubygems (`5347428e-e8c8-57fc-9684-11fb386ba37c`)
Product	Rubygems (`71142bdc-898b-5262-af64-3aa5698c056b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ruby-rubygems`	purl2cpe	2026-06-01 10:18:08.481924
`pkg:deb/ubuntu/ruby-rubygems`	purl2cpe	2026-06-01 10:18:08.481926
`pkg:gem/rubygems`	purl2cpe	2026-06-01 10:18:08.481927
`pkg:github/rubygems/rubygems`	purl2cpe	2026-06-01 10:18:08.481928
`pkg:rpm/fedora/rubygems`	purl2cpe	2026-06-01 10:18:08.481930
`pkg:rpm/opensuse/rubygems`	purl2cpe	2026-06-01 10:18:08.481931

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-0903`	vulnerable	2026-06-08 05:08:26.846444	Details available RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. Published: 2017-10-11T18:00:00.000Z Updated: 2024-09-17T03:54:57.184Z Open on db.gcve.eu Reference links https://usn.ubuntu.com/3685-1/ https://usn.ubuntu.com/3553-1/ https://access.redhat.com/errata/RHSA-2018:0585 https://access.redhat.com/errata/RHSA-2018:0378 https://hackerone.com/reports/274990	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-4020`	vulnerable	2026-06-08 05:06:39.009134	Details available RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900. Published: 2015-08-25T17:00:00.000Z Updated: 2024-08-06T06:04:02.680Z Open on db.gcve.eu Reference links http://blog.rubygems.org/2015/06/08/2.2.5-released.html https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/ http://www.securityfocus.com/bid/75431 https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478 http://blog.rubygems.org/2015/06/08/2.4.8-released.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-3900`	vulnerable	2026-06-08 05:06:38.725828	Details available RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack." Published: 2015-06-24T14:00:00.000Z Updated: 2024-08-06T05:56:16.332Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1657.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163502.html http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163600.html http://www.openwall.com/lists/oss-security/2015/06/26/2 https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4363`	vulnerable	2026-06-08 05:04:35.753857	Details available Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287. Published: 2013-10-17T23:00:00.000Z Updated: 2024-08-06T16:38:01.886Z Open on db.gcve.eu Reference links https://puppet.com/security/cve/cve-2013-4363 http://www.openwall.com/lists/oss-security/2013/09/18/8 http://blog.rubygems.org/2013/09/24/CVE-2013-4363.html http://www.openwall.com/lists/oss-security/2013/09/14/3 http://www.openwall.com/lists/oss-security/2013/09/20/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4287`	vulnerable	2026-06-08 05:04:35.254672	Details available Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. Published: 2013-10-17T23:00:00.000Z Updated: 2024-08-06T16:38:01.871Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/09/10/1 http://secunia.com/advisories/55381 http://rhn.redhat.com/errata/RHSA-2013-1523.html http://blog.rubygems.org/2013/09/09/CVE-2013-4287.html https://puppet.com/security/cve/cve-2013-4287	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.