RubyGems RubyGems 2.0.0 Preview 2.2
Approved changes feed: RSS · Atom
cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*
part: a version: 2.0.0 update: preview2.2
| Vendor | Rubygems (5347428e-e8c8-57fc-9684-11fb386ba37c) |
|---|---|
| Product | Rubygems (71142bdc-898b-5262-af64-3aa5698c056b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/ruby-rubygems |
purl2cpe | 2026-06-01 10:18:08.481802 |
pkg:deb/ubuntu/ruby-rubygems |
purl2cpe | 2026-06-01 10:18:08.481803 |
pkg:gem/rubygems |
purl2cpe | 2026-06-01 10:18:08.481804 |
pkg:github/rubygems/rubygems |
purl2cpe | 2026-06-01 10:18:08.481806 |
pkg:rpm/fedora/rubygems |
purl2cpe | 2026-06-01 10:18:08.481808 |
pkg:rpm/opensuse/rubygems |
purl2cpe | 2026-06-01 10:18:08.481809 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-0903 |
vulnerable | 2026-06-08 05:08:26.842918 |
Details available
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Published: 2017-10-11T18:00:00.000Z
Updated: 2024-09-17T03:54:57.184Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-4020 |
vulnerable | 2026-06-08 05:06:39.008064 |
Details available
RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.
Published: 2015-08-25T17:00:00.000Z
Updated: 2024-08-06T06:04:02.680Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-4363 |
vulnerable | 2026-06-08 05:04:35.752779 |
Details available
Algorithmic complexity vulnerability in Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression. NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
Published: 2013-10-17T23:00:00.000Z
Updated: 2024-08-06T16:38:01.886Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.