CVE-2012-2125
Fixed in a distro release EPSS 2%
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Products: rubygems
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rubygems-update | 1.8.23 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rubygems | 1.8.24-1 |
| Debian 13 | rubygems | 1.8.24-1 |
| Debian 14 | rubygems | 1.8.24-1 |
| Red Hat Enterprise Linux 6 | rubygems | 0:1.3.7-4.el6_4 |
| Red Hat enterprise mrg 2 computenode el6 | rubygems | 0:1.8.23.2-1.el6 |
| Red Hat enterprise mrg 2 server el6 | cumin | 0:0.1.5787-4.el6 |
| Red Hat enterprise mrg 2 server el6 | rubygems | 0:1.8.23.2-1.el6 |
| Red Hat openshift 1.2 | rubygems | 0:1.8.24-4.el6op |
| Ubuntu Pro 14.04 LTS | jruby | no fix |